vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-06 08:10:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8
spawn/upcloud
History
A e8dc7b4752
fix: replace unsafe inline API key injection with secure helpers (#676) 
8 scripts were embedding OPENROUTER_API_KEY directly into shell command
strings passed to run_server/run_in_codespace, allowing command injection
if the API key contains shell metacharacters (single quotes, semicolons,
backticks, etc.).

The worst case was latitude/continue.sh which had zero quoting:
  export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
allowing arbitrary command execution on the remote server with a
crafted API key value.

Fixed by replacing unsafe inline patterns with the existing secure
helpers (inject_env_vars_ssh, inject_env_vars_local, inject_env_vars)
which use generate_env_config to properly single-quote values with
embedded quote escaping.

Affected scripts:
- scaleway/continue.sh (single-quote breakout)
- upcloud/continue.sh (double-quote breakout)
- e2b/continue.sh (single-quote breakout)
- modal/continue.sh (single-quote breakout)
- daytona/continue.sh (single-quote breakout)
- latitude/continue.sh (no quoting at all - critical)
- github-codespaces/continue.sh (single-quote breakout)
- kamatera/nanoclaw.sh (single-quote breakout in .env write)

Agent: security-auditor

Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 15:03:12 -08:00
..
lib refactor: extract get_validated_server_name to eliminate 18 duplicate get_server_name functions (#535) 2026-02-11 14:42:09 -08:00
aider.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
amazonq.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
claude.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
cline.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
codex.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
continue.sh fix: replace unsafe inline API key injection with secure helpers (#676) 2026-02-12 15:03:12 -08:00
gemini.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
goose.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
gptme.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
interpreter.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
kilocode.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
nanoclaw.sh fix: replace log_warn with log_step/log_info for non-warning messages (#604) 2026-02-12 03:24:30 -08:00
openclaw.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
opencode.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
plandex.sh fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
README.md Add RunPod GPU cloud provider (#39) 2026-02-07 21:43:10 -08:00

README.md

UpCloud

UpCloud cloud servers via REST API. UpCloud

Agents

Claude Code

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/claude.sh)

OpenClaw

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/openclaw.sh)

NanoClaw

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/nanoclaw.sh)

Aider

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/aider.sh)

Goose

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/goose.sh)

Codex CLI

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/codex.sh)

Open Interpreter

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/interpreter.sh)

Gemini CLI

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/gemini.sh)

Amazon Q CLI

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/amazonq.sh)

Cline

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/cline.sh)

gptme

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/gptme.sh)

OpenCode

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/opencode.sh)

Plandex

bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/plandex.sh)

Non-Interactive Mode

UPCLOUD_SERVER_NAME=dev-mk1 \
UPCLOUD_USERNAME=your-api-username \
UPCLOUD_PASSWORD=your-api-password \
OPENROUTER_API_KEY=sk-or-v1-xxxxx \
  bash <(curl -fsSL https://openrouter.ai/lab/spawn/upcloud/claude.sh)

Environment Variables

Variable Description Default
UPCLOUD_USERNAME UpCloud API username (prompted)
UPCLOUD_PASSWORD UpCloud API password (prompted)
UPCLOUD_SERVER_NAME Server name (prompted)
UPCLOUD_ZONE Datacenter zone de-fra1
UPCLOUD_PLAN Server plan 1xCPU-2GB
OPENROUTER_API_KEY OpenRouter API key (OAuth or prompted)