@raishin/vanguard-frontier-agentic 1.6.0 → 1.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,6 +42,7 @@
     "test:copilot-bundling": "python3 tests/test-copilot-skill-bundling.py",
     "test:gemini-bundling": "python3 tests/test-gemini-skill-bundling.py",
     "test:cursor-kiro-notices": "node tests/export-cursor-kiro-skill-notice.test.mjs",
+    "test:fuzz": "node tests/fuzz-properties.test.mjs",
     "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:links",
     "release:sbom": "command -v syft >/dev/null 2>&1 && syft scan dir:. -o spdx-json=sbom.spdx.json || echo 'syft not installed; SBOM is generated in CI by anchore/sbom-action'",
     "lint:md": "npx --yes markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#.code-review-graph\" \"#CHANGELOG.md\"",
@@ -49,14 +50,15 @@
     "lint:docs": "npm run lint:md && npm run lint:spell"
   },
   "devDependencies": {
-    "semantic-release": "25.0.3",
     "@semantic-release/changelog": "6.0.3",
+    "@semantic-release/commit-analyzer": "13.0.1",
     "@semantic-release/git": "10.0.1",
-    "@semantic-release/npm": "13.1.5",
     "@semantic-release/github": "12.0.6",
-    "@semantic-release/commit-analyzer": "13.0.1",
+    "@semantic-release/npm": "13.1.5",
     "@semantic-release/release-notes-generator": "14.1.0",
-    "conventional-changelog-conventionalcommits": "9.3.1"
+    "conventional-changelog-conventionalcommits": "9.3.1",
+    "fast-check": "^4.7.0",
+    "semantic-release": "25.0.3"
   },
   "publishConfig": {
     "access": "public",

package/schemas/agent.schema.json

@@ -41,6 +41,11 @@
         "gcp",
         "alibaba",
         "huawei",
+        "ovhcloud",
+        "ionos",
+        "scaleway",
+        "hetzner",
+        "contabo",
         "kubernetes",
         "terraform",
         "multi-cloud",

package/scripts/export-marketplace-agents.mjs

@@ -233,7 +233,7 @@ function loadAgents() {
 
 function normalizePlatform(platform) {
   const lowered = platform.toLowerCase();
-  return PLATFORM_ALIASES[lowered] ?? lowered;
+  return Object.hasOwn(PLATFORM_ALIASES, lowered) ? PLATFORM_ALIASES[lowered] : lowered;
 }
 
 function ensurePlatform(platform) {

package/skills/contabo/contabo-capacity-planner/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: contabo-capacity-planner
+description: Advisory skill for Contabo resource planning across regions (EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND), instance tiers (VPS, VDS, Storage VPS), and add-ons (Private Networking, Additional IPs, Extra Storage, Custom Images). Includes Cloud-Init userData strategy and SSH key management via secret IDs. Use when the user needs to plan new deployments, evaluate region coverage, or compare instance tiers.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: platform
+---
+
+# Contabo Capacity Planner
+
+## Purpose
+
+Act as the Contabo capacity planning advisor: evaluate resource needs, map them to appropriate instance tiers and regions, and produce deployment plans that declare contract period obligations upfront.
+
+## When to use
+
+Use this skill for:
+
+- Planning new VPS, VDS, or Storage VPS deployments across Contabo regions
+- Evaluating region coverage for latency, compliance, or redundancy requirements
+- Comparing instance tiers (VPS shared vs. VDS dedicated) for workload fit
+- Designing Cloud-Init userData for reproducible instance configuration
+- SSH key strategy using Contabo secret IDs (never raw key material in API calls)
+- Addon selection: Private Networking, Additional IPs, Extra Storage, Custom Images
+- Scaling assessments and multi-region topology design
+
+## Lean operating rules
+
+- Contabo has no official Terraform provider or SDK — recommend `cntb` CLI or REST API (curl + jq) for automation.
+- Prefer official Contabo docs (https://api.contabo.com/, https://docs.contabo.com/) and Context7 when live MCP access is unavailable.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Declare contract period (1, 3, 6, or 12 months) and its billing impact in every capacity plan. Period selection is binding at instance creation.
+- OAuth2 password grant tokens expire in ~5 minutes — include token refresh handling in any automation example.
+- Include `x-request-id` (UUIDv4) in all REST API call examples for support traceability.
+- Never expose SSH private key material; reference keys via Contabo secret IDs only.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## Contabo regions reference
+
+| Region code | Location |
+|---|---|
+| EU | European Union (primary, default) |
+| UK | United Kingdom (London) |
+| US-central | United States Central |
+| US-east | United States East |
+| US-west | United States West |
+| SIN | Singapore |
+| JPN | Japan |
+| IND | India |
+| AUS | Australia (Sydney) |
+
+## Response minimum
+
+Return, at minimum:
+
+- the target region(s) and instance tier(s) with justification,
+- the declared contract period and its billing implications,
+- addon requirements and their activation steps,
+- Cloud-Init or SSH key strategy where applicable,
+- the assumptions or blockers that prevent stronger conclusions.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full capacity planning review or formatting the deployment plan output.
+- [Safety checklist](references/safety-checklist.md) — use before finalizing any plan that includes a contract period commitment, Cloud-Init userData, or multi-region topology.
+- [Official sources](references/official-sources.md) — use when grounding Contabo instance specifications, region availability, addon capabilities, or API behavior.

package/skills/contabo/contabo-capacity-planner/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "contabo-capacity-planner",
+  "name": "Contabo Capacity Planner",
+  "type": "skill",
+  "provider": "contabo",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Advisory skill for Contabo resource planning across regions (EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND), instance tiers (VPS, VDS, Storage VPS), and add-ons including Private Networking, Additional IPs, Extra Storage, and Custom Images.",
+  "source_type": "original",
+  "official_docs": [
+    "https://api.contabo.com/",
+    "https://docs.contabo.com/",
+    "https://contabo.com/en/vps/"
+  ],
+  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — never cache or log them. Credentials must remain in environment variables. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual periods (1, 3, 6, 12 months) are binding at instance creation — capacity plans must declare the period and its billing impact. SSH keys are managed as secret IDs; never expose raw key material in plans or API calls.",
+  "last_verified": "2026-05-10",
+  "path": "skills/contabo/contabo-capacity-planner",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/contabo/contabo-capacity-planner/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference only when grounding Contabo instance specifications, region availability, addon capabilities, or API behavior for capacity planning.
+
+## Contabo documentation
+
+Use these as starting points, not as proof of current product availability or the user's live account state:
+
+- https://api.contabo.com/ — Contabo OpenAPI reference (instance creation, product IDs, region codes, addon parameters)
+- https://docs.contabo.com/ — Contabo user documentation (instance types, region coverage, Cloud-Init guides, Private Networking setup)
+- https://github.com/contabo/cntb — cntb CLI tool (instance listing, secret management, Cloud-Init deployment)
+- https://api.contabo.com/#tag/Instances — Instance operations API (product selection, region, userData, SSH secret IDs, addons)
+
+## Grounding rule
+
+Official Contabo documentation describes available instance tiers, region codes, addon capabilities, and API contract behavior at the time of publication. It does not prove current product availability in a specific region, live pricing, the user's active instances, or whether a particular addon can be added after creation. Prefer user-provided sanitized evidence or live read-only API responses for current-state claims. Label any instance specification or region availability claim sourced only from documentation as `documentation-based`. Confirm region-specific product availability via the API or Contabo support before committing to a multi-region plan.

package/skills/contabo/contabo-capacity-planner/references/safety-checklist.md

@@ -0,0 +1,26 @@
+# Safety checklist
+
+Use this reference before producing a capacity plan that includes a contract period commitment, instance tier recommendation, Cloud-Init userData, or multi-region topology.
+
+## Non-negotiables
+
+- Never ask users to paste OAuth2 tokens, client secrets, API passwords, SSH private keys, or S3 secret keys into chat.
+- SSH keys must always be referenced by Contabo secret IDs — never include raw private key material in API payloads, Cloud-Init fragments, or recommendations.
+- Do not invent instance specifications, region availability, pricing, or contract terms. Label all specification claims as `documentation-based` since products and pricing may change.
+- Require explicit acknowledgment of the contract period and its billing obligation before finalizing any deployment plan. Period selection is binding at instance creation and cannot be shortened.
+- Review all Cloud-Init userData for embedded secrets, curl-pipe-sh patterns, hardcoded credentials, and commands that disable audit logging before including it in any plan output. Refuse to include userData that fails this review.
+- Do not recommend a multi-region topology without confirming that required instance types and addons are available in all target regions.
+- OAuth2 token values must never appear in plan output, scripts, or echo statements.
+
+## Stress checks
+
+- Does the selected contract period create an irreversible billing obligation that exceeds the user's stated budget or timeline? → Surface and require acknowledgment.
+- Does the Cloud-Init userData contain raw credentials, unauthenticated package sources, or curl-pipe-sh execution? → Flag and refuse to include without remediation.
+- Is the selected instance tier based on actual utilization data or inferred from a general workload description? → Label as inference if not confirmed.
+- Does the plan require addons (Private Networking, Additional IPs) that may not be available or require separate provisioning steps in the target region? → Confirm availability before committing.
+- What is the recovery path if Cloud-Init provisioning fails and the instance is in an unknown state?
+- Is there a confirmed SSH access path that does not depend solely on Cloud-Init completing successfully?
+
+## Evidence labels
+
+Use `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`. Capacity plans built on inference alone must be clearly flagged as preliminary estimates requiring evidence confirmation before committing to a contract period.

package/skills/contabo/contabo-capacity-planner/references/workflow-and-output.md

@@ -0,0 +1,73 @@
+# Workflow and output contract
+
+Use this reference only when performing a full capacity planning review, deployment design, region evaluation, or instance tier comparison for a Contabo environment.
+
+## Review domains
+
+Check these areas before producing a capacity plan:
+
+- Region selection: latency targets, compliance constraints, region availability, and redundancy requirements
+- Instance tier fit: VPS (shared) vs. VDS (dedicated) vs. Storage VPS — CPU, RAM, storage, and network ceiling for the declared workload
+- Contract period selection: 1/3/6/12-month obligations and their billing commitment at creation time
+- Cloud-Init userData strategy: reproducibility, secret hygiene, and idempotency of the provisioning script
+- SSH key strategy: Contabo secret IDs referenced in API payloads, never raw private key material
+- Addon requirements: Private Networking (VLANs across instances), Additional IPs, Extra Storage, Custom Images
+- Scaling topology: single-region vs. multi-region, horizontal scaling constraints, and network topology
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload type and expected resource demand (CPU, RAM, storage IOPS, bandwidth):
+   - Target region(s) and latency or compliance constraints:
+   - Required contract period and budget envelope:
+   - Cloud-Init or SSH key strategy requirements:
+   - Explicit non-goals (e.g., no dedicated resources, no multi-region):
+
+2. **Collect evidence**
+   - Prefer user-provided workload data (utilization metrics, peak demand, team size, SLA targets).
+   - Use read-only Contabo API calls for current instance inventory if live access is available.
+   - Ground instance tier specs and region availability in official Contabo docs; label as `documentation-based` since specifications may change.
+   - Label each claim as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+
+3. **Stress-test the plan**
+   - Does the selected instance tier have headroom for peak load or burst?
+   - Is the declared contract period the lowest lock-in option that still meets the cost target?
+   - Does the region have all required instance types and addons available?
+   - Is the Cloud-Init userData free of embedded secrets or unauthenticated remote execution?
+   - What is the recovery path if provisioning fails mid-flight?
+
+4. **Recommend the smallest safe plan**
+   - Prefer the lowest contract period that meets the budget, unless a longer period is justified by stability and cost savings.
+   - Always declare the contract period and billing obligation explicitly in the plan output.
+   - If the safest action is to start with a single VPS and scale, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Contabo Capacity Plan: <scope>
+## Executive summary
+- Status: READY TO DEPLOY / READY WITH CAVEATS / NEEDS EVIDENCE
+- Selected region(s):
+- Selected instance tier(s):
+- Contract period: <1 | 3 | 6 | 12> months — billing obligation acknowledged
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Instance plan
+| Region | Instance tier | vCPUs | RAM | Storage | Contract | Monthly cost (est.) |
+|---|---|---|---|---|---|---|
+## Addon requirements
+- <addon and justification or "none">
+## Cloud-Init / SSH key strategy
+- <strategy or "not required">
+## Deployment sequence
+1. <step> — validation: <check>
+## Rollback or recovery path
+- <path>
+## Residual risk
+- <risk or explicit none>
+```

package/skills/contabo/contabo-cost-optimization-analyst/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: contabo-cost-optimization-analyst
+description: Advisory skill for analyzing Contabo cost posture across contract periods, VPS/VDS product tiers, Storage VPS options, and add-ons including Private Networking, Additional IPs, Extra Storage, and Custom Images. Use when the user asks to reduce, explain, or optimize Contabo spending or when evaluating billing impact of period or sizing changes.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: finops
+---
+
+# Contabo Cost Optimization Analyst
+
+## Purpose
+
+Act as the Contabo cost optimization analyst: surface spending inefficiencies across contract periods, instance sizing, and addon utilization without creating new billing obligations.
+
+## When to use
+
+Use this skill for:
+
+- Contabo bill review, spending spike, forecast, or cost allocation questions
+- Contract period analysis (1, 3, 6, 12 months) and consolidation recommendations
+- VPS/VDS rightsizing and tier comparison (shared vs. dedicated resources)
+- Storage VPS and Object Storage cost evaluation
+- Addon utilization review (Private Networking, Additional IPs, Extra Storage, Custom Images)
+- Billing impact assessment before any instance creation, reinstallation, or cancellation
+
+## Lean operating rules
+
+- Contabo has no official Terraform provider or SDK — recommend `cntb` CLI or REST API (curl + jq) for automation.
+- Prefer official Contabo docs (https://api.contabo.com/, https://docs.contabo.com/) and Context7 when live MCP access is unavailable.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Surface billing impact explicitly before any sizing or period change recommendation. Contractual periods (1, 3, 6, 12 months) create irreversible financial obligations.
+- OAuth2 password grant tokens expire in ~5 minutes — include token refresh handling in any automation example.
+- Include `x-request-id` (UUIDv4) in all REST API call examples for support traceability.
+- Challenge broad access, destructive automation, untested recovery, hidden cost, and vague billing claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped cost target and evidence level,
+- the main billing risks or period obligations,
+- the safest rightsizing or consolidation actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full cost review, billing impact assessment, or formatting the structured cost report.
+- [Safety checklist](references/safety-checklist.md) — use before making recommendations that commit a contract period, cancel an instance, or modify addon subscriptions.
+- [Official sources](references/official-sources.md) — use when grounding Contabo pricing, contract terms, instance tiers, or billing behavior.

package/skills/contabo/contabo-cost-optimization-analyst/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "contabo-cost-optimization-analyst",
+  "name": "Contabo Cost Optimization Analyst",
+  "type": "skill",
+  "provider": "contabo",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Advisory skill for analyzing Contabo cost posture across contract periods, VPS/VDS product tiers, Storage VPS options, and add-ons including Private Networking, Additional IPs, Extra Storage, and Custom Images.",
+  "source_type": "original",
+  "official_docs": [
+    "https://api.contabo.com/",
+    "https://docs.contabo.com/",
+    "https://contabo.com/en/vps/"
+  ],
+  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — never cache or log them. Store CONTABO_CLIENT_ID, CONTABO_CLIENT_SECRET, CONTABO_API_USER, CONTABO_API_PASSWORD in environment variables only. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual billing periods (1, 3, 6, 12 months) create irreversible obligations — always surface billing impact before any sizing or period recommendation.",
+  "last_verified": "2026-05-10",
+  "path": "skills/contabo/contabo-cost-optimization-analyst",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/contabo/contabo-cost-optimization-analyst/references/official-sources.md

@@ -0,0 +1,17 @@
+# Official sources
+
+Use this reference only when grounding Contabo pricing, contract terms, instance tiers, or billing behavior.
+
+## Contabo documentation
+
+Use these as starting points, not as proof of the user's live billing state or current pricing:
+
+- https://api.contabo.com/ — Contabo OpenAPI reference (instance, addon, and Object Storage endpoints)
+- https://docs.contabo.com/ — Contabo user documentation (plans, pricing pages, contract terms, billing FAQ)
+- https://github.com/contabo/cntb — cntb CLI tool (instance list and addon queries for live cost inventory)
+- https://api.contabo.com/#tag/Instances — Instance operations API (product IDs, regions, addons)
+- https://api.contabo.com/#tag/Object-Storages — Object Storage API (storage instance inventory and sizing)
+
+## Grounding rule
+
+Official Contabo documentation describes available product tiers, published pricing, and contract terms at the time of publication. It does not prove the user's current instance costs, active addon subscriptions, contract renewal dates, or applied discounts. Published pricing may differ from the user's account pricing due to promotional rates or legacy contracts. Label all pricing claims as `documentation-based` and direct the user to their Contabo customer portal for authoritative billing data. Never present documentation-based pricing as confirmed cost figures.

package/skills/contabo/contabo-cost-optimization-analyst/references/safety-checklist.md

@@ -0,0 +1,25 @@
+# Safety checklist
+
+Use this reference before making recommendations that commit a new contract period, cancel an instance, change instance sizing, or modify addon subscriptions on live Contabo accounts.
+
+## Non-negotiables
+
+- Never ask users to paste OAuth2 tokens, client secrets, API passwords, or billing credentials into chat.
+- Do not invent pricing, contract period terms, renewal dates, or billing impact figures. Label all pricing claims as `documentation-based` and note that published prices may change.
+- Require explicit user acknowledgment of the financial obligation before recommending any action that creates or extends a contract period (1, 3, 6, or 12 months).
+- Do not recommend instance cancellation without surfacing the remaining period, any early-termination terms, and the data/service impact of cancellation.
+- Treat a contract period change as irreversible once committed — do not present it as easily undoable.
+- Surface addon removal impact (e.g., losing Private Networking connectivity, releasing Additional IPs) before recommending addon cancellation.
+- If the user's billing state is unknown or described only in general terms, request evidence before making specific cost-saving claims.
+
+## Stress checks
+
+- Does this recommendation lock in a new contract period? → Explicit acknowledgment required before routing to any lifecycle action.
+- Does this addon cancellation remove network connectivity or IP addresses that active instances depend on? → Surface blast radius before recommending.
+- Is this rightsizing recommendation based on actual utilization data or is it an inference from stated workload? → Label and request evidence if inference.
+- Does a period downgrade save money but expose a renewal gap or service interruption risk? → State that explicitly.
+- What upcoming renewals will create new obligations if not acted on before the billing cycle closes?
+
+## Evidence labels
+
+Use `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`. Cost claims made on inference alone must be flagged as estimates, not confirmed savings.

package/skills/contabo/contabo-cost-optimization-analyst/references/workflow-and-output.md

@@ -0,0 +1,63 @@
+# Workflow and output contract
+
+Use this reference only when performing a full cost review, billing impact assessment, contract period analysis, or rightsizing recommendation for a Contabo environment.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- Contract period obligations: active periods (1/3/6/12 months), renewal dates, early-termination implications
+- Instance sizing: VPS tier vs. VDS dedicated, CPU/RAM/storage fit for the declared workload
+- Storage VPS vs. Object Storage: cost and capability tradeoffs for storage-heavy workloads
+- Addon utilization: Private Networking, Additional IPs, Extra Storage, Custom Images — used vs. provisioned
+- Billing event horizon: upcoming renewals, period changes, or instance operations that will create new obligations
+- Spending anomalies: unexpected charges, orphaned addons, redundant instances
+
+## Safe workflow
+
+1. **Frame scope**
+   - Account or instance(s) under review:
+   - Business context (workload type, team, budget owner):
+   - Optimization goal (reduce cost, right-size, consolidate, forecast):
+   - Current contract periods and renewal exposure:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer user-provided billing summaries, instance lists, or addon inventories.
+   - Use read-only Contabo API calls for instance and addon state if live access is available.
+   - Ground pricing claims in official Contabo documentation; label pricing as `documentation-based` since published prices may change.
+   - Label each finding as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What contract period change creates an irreversible billing obligation?
+   - What addon is provisioned but unused or underutilized?
+   - What instance is oversized relative to observed or stated utilization?
+   - What renewal is approaching that requires a decision within the next billing cycle?
+   - What evidence is missing that would change the cost assessment?
+4. **Recommend the smallest safe action**
+   - Prefer changes that reduce cost without creating new contractual lock-in.
+   - State the financial impact and obligation of each recommendation explicitly.
+   - If the safest action is to wait for a renewal window before changing periods, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Contabo Cost Optimization Review: <scope>
+## Executive verdict
+- Status: OPTIMIZED / OPTIMIZED WITH GAPS / COST RISK / NEEDS EVIDENCE
+- Biggest cost risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Priority | Finding | Evidence | Financial impact | Recommended action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — billing impact: <impact>, contract risk: <risk>, validation: <check>
+## Billing event horizon
+- Upcoming renewals or decisions:
+## Residual risk
+- <risk or explicit none>
+```

package/skills/contabo/contabo-live-instance-lifecycle-guard/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: contabo-live-instance-lifecycle-guard
+description: Live-guard skill for Contabo VPS and VDS lifecycle operations including instance creation with product selection and region, reinstallation with image and Cloud-Init userData, and cancellation. Requires mandatory contract period acknowledgment (1, 3, 6, or 12 months), billing impact confirmation, and a rollback plan before any mutation. Hard-stops any lifecycle action that lacks explicit period acknowledgment or rollback documentation.
+allowed-tools: Read Grep Glob Bash
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: platform
+---
+
+# Contabo Live Instance Lifecycle Guard
+
+## Purpose
+
+Act as the approval gate for Contabo VPS/VDS lifecycle mutations: inventory current state, surface billing obligations, confirm the rollback path, then execute only after explicit user sign-off on all three.
+
+## When to use
+
+Use this skill for:
+
+- VPS or VDS instance creation (product selection, region, image, contract period, Cloud-Init userData, SSH key secret IDs)
+- Instance reinstallation (image change, userData update, SSH key rotation)
+- Instance cancellation (period remaining, early-termination billing impact)
+- Verifying instance inventory before any bulk lifecycle operation
+- Generating approval-ready change records with period, billing impact, and rollback plan
+
+## Hard-stop conditions
+
+REFUSE to execute any mutation unless ALL of the following are confirmed in writing:
+
+1. **Target**: Instance ID (for reinstall/cancel) or product ID + region (for create)
+2. **Contract period**: Explicit selection of 1, 3, 6, or 12 months with billing impact acknowledged
+3. **Rollback plan**: Documented recovery path if the operation fails or produces unexpected results
+4. **Named approving identity**: the full name or authenticated account identifier of the person authorizing this operation (not a role, alias, or ticket number alone)
+
+## Lean operating rules
+
+- Contabo has no official Terraform provider or SDK — recommend `cntb` CLI or REST API (curl + jq) for automation.
+- Prefer official Contabo docs (https://api.contabo.com/, https://docs.contabo.com/) and Context7 when live MCP access is unavailable.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- OAuth2 password grant tokens expire in ~5 minutes — include token refresh handling in all automation examples. Refresh logic must not log token values.
+- Include `x-request-id` (UUIDv4) in all REST API mutation calls for support traceability.
+- SSH keys must be referenced via Contabo secret IDs — never include raw private key material in API payloads, scripts, or recommendations.
+- Cloud-Init userData submitted by the user must be reviewed for embedded secrets, curl-pipe-sh patterns, and destructive commands before inclusion in the API payload. Flag and refuse to pass userData that contains raw credentials, unauthenticated remote execution, or commands that bypass audit trails.
+- Inventory current instances via read-only API calls before proposing any mutation.
+- Label claims as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+
+## Automation pattern (read-only inventory first)
+
+```bash
+# Load credentials from environment — never hardcode
+: "${CONTABO_CLIENT_ID:?set in env}"
+: "${CONTABO_CLIENT_SECRET:?set in env}"
+: "${CONTABO_API_USER:?set in env}"
+: "${CONTABO_API_PASSWORD:?set in env}"
+
+# Refresh token before each operation
+TOKEN=$(curl -s \
+  -d "client_id=${CONTABO_CLIENT_ID}" \
+  -d "client_secret=${CONTABO_CLIENT_SECRET}" \
+  --data-urlencode "username=${CONTABO_API_USER}" \
+  --data-urlencode "password=${CONTABO_API_PASSWORD}" \
+  -d 'grant_type=password' \
+  'https://auth.contabo.com/auth/realms/contabo/protocol/openid-connect/token' \
+  | jq -r '.access_token')
+
+# Read-only inventory
+curl -s \
+  -H "Authorization: Bearer ${TOKEN}" \
+  -H "x-request-id: $(uuidgen)" \
+  'https://api.contabo.com/v1/compute/instances' | jq .
+```
+
+## Response minimum
+
+Return, at minimum:
+
+- the target instance or product tier and evidence level,
+- the contract period with billing impact,
+- the hard-stop checklist status (all three items confirmed or blocked),
+- the rollback plan,
+- the assumptions or open questions that require user clarification before proceeding.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full lifecycle operation or formatting the approval-ready change record.
+- [Safety checklist](references/safety-checklist.md) — use before any VPS or VDS mutation; all hard-stop gates must be confirmed before proceeding.
+- [Official sources](references/official-sources.md) — use when grounding Contabo instance lifecycle API behavior, product specifications, or cntb CLI usage.

package/skills/contabo/contabo-live-instance-lifecycle-guard/metadata.json

@@ -0,0 +1,25 @@
+{
+  "id": "contabo-live-instance-lifecycle-guard",
+  "name": "Contabo Live Instance Lifecycle Guard",
+  "type": "skill",
+  "provider": "contabo",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Live-guard skill for Contabo VPS/VDS lifecycle operations including instance creation, reinstallation, and cancellation with mandatory contract period acknowledgment, billing impact confirmation, and rollback plan before any mutation.",
+  "source_type": "original",
+  "official_docs": [
+    "https://api.contabo.com/",
+    "https://docs.contabo.com/"
+  ],
+  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — refresh handling must not log token values. Credentials must remain in environment variables. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API with curl + jq. Contractual periods (1, 3, 6, 12 months) are binding at creation — cancellation may incur early-termination billing. x-request-id (UUIDv4) is mandatory for all mutation calls. Hard-stop on any lifecycle action without explicit period acknowledgment and rollback plan.",
+  "last_verified": "2026-05-10",
+  "path": "skills/contabo/contabo-live-instance-lifecycle-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/contabo/contabo-live-instance-lifecycle-guard/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference only when grounding Contabo instance lifecycle API behavior, product specifications, or cntb CLI usage for create, reinstall, or cancel operations.
+
+## Contabo documentation
+
+Use these as starting points, not as proof of the user's live instance state or current product availability:
+
+- https://api.contabo.com/#tag/Instances — Instance operations API (create, reinstall, cancel, list, get — includes product IDs, region codes, image IDs, Cloud-Init userData, SSH secret ID parameters)
+- https://api.contabo.com/ — Contabo OpenAPI reference (authentication flows, request headers including x-request-id, error response schemas)
+- https://docs.contabo.com/ — Contabo user documentation (instance management guides, Cloud-Init setup, contract period terms, cancellation policy)
+- https://github.com/contabo/cntb — cntb CLI tool (instance create, reinstall, cancel commands; credential configuration; token refresh patterns)
+
+## Grounding rule
+
+Official Contabo documentation describes API endpoint behavior, available product IDs, supported image IDs, and contract terms at the time of publication. It does not prove the user's current instance inventory, active contract state, remaining period, available product IDs in a specific region at the time of the request, or OAuth2 token validity. Prefer live read-only API responses or user-provided sanitized evidence for current-state claims. Label any product availability, image ID, or contract term claim sourced only from documentation as `documentation-based`. Always refresh the OAuth2 token immediately before the mutation call — do not rely on a token that was retrieved earlier in the session.