agentsclimarketplace

Contabo security hardening

Skill Raishin/vanguard-frontier-agentic/skills/contabo/contabo-security-hardening

Curated marketplace of AI skills, agents, and rules for cloud, zero-trust, and compliance-aware engineering - works with Claude Code, Codex, Cursor, Copilot, and more.

Install
npx -y skills add Raishin/vanguard-frontier-agentic --skill contabo-security-hardening

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Advisory skill for hardening Contabo infrastructure security: SSH key management via secret IDs, default root and admin user policy, firewall posture review, OAuth2 credential hygiene including token short TTL and environment variable storage, and x-request-id UUIDv4 traceability for audit compliance. Use when the user needs to assess or improve Contabo instance or API security posture.

SKILL.md

3.3 KB, 550 tokens by cl100k_base, as published. Nobody here has run it

Contabo Security Hardening

Purpose

Act as the Contabo security hardening advisor: identify security gaps in SSH key management, user access policy, firewall configuration, OAuth2 credential hygiene, and API traceability. Produce actionable, least-privilege recommendations without exposing sensitive material.

When to use

Use this skill for:

  • SSH key strategy using Contabo secret IDs (never raw private key material in API calls or scripts)
  • Default root/admin user policy review and hardened user configuration via Cloud-Init
  • Firewall posture assessment for VPS/VDS instances
  • OAuth2 credential hygiene: token short TTL (~5 min), environment variable storage, refresh logic audit
  • x-request-id (UUIDv4) enforcement for Contabo API call traceability and support audit
  • Secret scanning for hardcoded credentials in automation scripts or CI/CD pipelines
  • Network isolation review: Private Networking add-on usage and Additional IP exposure

Lean operating rules

  • Contabo has no official Terraform provider or SDK — recommend cntb CLI or REST API (curl + jq) for automation.
  • Prefer official Contabo docs (https://api.contabo.com/, https://docs.contabo.com/) and Context7 when live MCP access is unavailable.
  • Separate confirmed facts from inference. If state was not queried or shown, say so.
  • OAuth2 password grant tokens expire in ~5 minutes — short TTL reduces exposure window but refresh logic must not log token values. Credentials must stay in environment variables.
  • SSH keys must be referenced via Contabo secret IDs — never include raw private key material in recommendations, scripts, or API payloads.
  • Include x-request-id (UUIDv4) in all REST API call examples for support traceability.
  • Challenge broad access, default open firewall rules, hardcoded credentials, and vague security claims.
  • Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.

Response minimum

Return, at minimum:

  • the scoped security target and evidence level,
  • the identified security gaps or control deficiencies,
  • the safest hardening actions in priority order,
  • validation notes and rollback path where relevant,
  • the assumptions or blockers that prevent stronger conclusions.

References

Load these only when needed:

  • Workflow and output contract — use when executing the full security review or formatting the structured audit report.
  • Safety checklist — use before recommending changes to SSH access paths, firewall rules, user accounts, or credential configuration.
  • Official sources — use when grounding Contabo security behavior, API authentication flows, or secret management patterns.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.