Devops Deploy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 1.0.0

Overview

This deployment skill is coherent, but it includes copy-paste commands that can run unverified remote installers and delete backups without safeguards.

Review the deployment commands before installing or using this skill. Do not let an agent run the Fly.io pipe-to-shell installer, unpinned global CLI installs, S3 backup deletion, or database restore commands without explicit confirmation and safer checks such as pinned versions, verified installers, private temporary files, dry-run deletion, and verified non-production restore targets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/deployment-guides.md:59

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: references/deployment-guides.md, line 59
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash

curl -L https://fly.io/install.sh | sh

Technical Analysis

The command streams mutable content from an external endpoint directly into sh. It follows redirects and provides no version pinning, cryptographic checksum verification, signature validation, or opportunity to inspect the downloaded script before execution.

Installing the Fly.io CLI supports the Skill's stated deployment functionality, but executing an unverified remote script is not the minimum capability necessary to perform that task. The effective payload can change after the Skill has been reviewed. Compromise of the hosting endpoint, redirect chain, DNS or TLS trust path, or upstream publishing process would allow attacker-controlled shell commands to run with the invoking user's privileges.

Attack Path

1. A user requests assistance deploying an application through Fly.io.
2. The agent follows the referenced deployment guide and recommends or executes the installation command.
3. curl retrieves the current content from the remote endpoint and follows any redirects.
4. The downloaded content is passed directly to sh without verification.
5. If the remote content or delivery path has been compromised, attacker-supplied commands execute immediately.
6. Those commands can access files, credentials, environment variables, and services available to the invoking account.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user running the command. Depending on that account's access, an attacker could steal deployment credentials, cloud tokens, SSH keys, source code, and environment secrets; alter local files; tamper with deployment artifacts; or establish persistence. The immediate scope is the invoking acco ...[truncated 61 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pipe network responses directly into a command interpreter.
• Prefer an official package manager or a version-pinned release artifact from a verified publisher.
• Download the artifact to a local file as a separate step.
• Verify a publisher-provided cryptographic checksum and, where available, a release signature.
• Inspect the installer before executing it.
• Run installation with an unprivileged account and avoid sudo unless a specific filesystem operation requires it.
• Pin the documented CLI version so future remote changes do not silently alter the reviewed installation process.

T08 · Insecure Dependencies

Warning

• Location: references/deployment-guides.md:6

Finding

Unpinned Global Installation of Deployment CLI Packages

Content

View full analysis

Vulnerability Details

File Location: references/deployment-guides.md, lines 6 and 31
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

bash

npm i -g vercel
npm i -g @railway/cli

Technical Analysis

These commands install mutable latest versions of third-party packages globally. No reviewed version is pinned, and the instructions do not establish lockfile-based reproducibility or an independent integrity-verification procedure. npm packages may execute lifecycle scripts during installation, while global installation places their executable commands into the user's wider environment.

The packages are relevant to the declared deployment functionality and there is no evidence that the named packages are intentionally malicious. The risk arises from trusting mutable package versions and their transitive dependency chains. A compromised publisher account, registry incident, malicious future release, or dependency-chain compromise could introduce code that executes during installation or when the globally installed CLI is invoked.

Attack Path

1. A user follows the Vercel or Railway setup instructions.
2. npm resolves the package name to the registry's current release rather than a reviewed version.
3. npm downloads the package and its transitive dependencies.
4. Installation lifecycle code, if present, runs with the user's privileges.
5. A compromised release can access the user's files and environment or install a modified global executable.
6. The modified CLI may execute again during later deployment operations, potentially gaining access to deployment credentials and application configuration.

Impact Assessment

Exploitation could result in arbitrary code execution under the installing account, theft of local or deployment credentials, tampering with source code and build artifacts, or replacement of globally available CLI commands. The affected scope i ...[truncated 129 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each CLI to a reviewed exact version rather than implicitly installing latest.
• Prefer project-local or isolated ephemeral installation over global installation where practical.
• Preserve lockfile and registry integrity metadata when the installation model supports it.
• Use only the expected trusted npm registry and verify package publisher and provenance information.
• Disable lifecycle scripts when they are not required and test that the CLI remains functional.
• Establish a controlled update process that reviews release notes, provenance, and integrity before changing pinned versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/deployment-guides.md:74

Finding

Database Backup Written to a Predictable Shared Temporary Path

Content

View full analysis

Vulnerability Details

File Location: references/deployment-guides.md, lines 74–78
Vulnerability Type: Unsafe temporary-file handling of sensitive data
Risk Level: Medium

bash

DATE=$(date +%Y%m%d_%H%M%S)
FILENAME="backup_${DATE}.sql.gz"

pg_dump $DATABASE_URL | gzip > /tmp/$FILENAME
aws s3 cp /tmp/$FILENAME s3://my-backups/$FILENAME

Technical Analysis

The backup filename is derived from a predictable timestamp and is created beneath the shared /tmp directory through ordinary shell redirection. The script does not use an atomic secure temporary-file operation, reject symbolic links, create a private directory, or establish a restrictive umask. Variable expansions are also unquoted.

On a multi-user system, another local user may be able to predict the filename and pre-create it as a symbolic link. When a more privileged backup process opens the path for output, the shell can follow that link and overwrite another file writable by the backup account. Default permissions or failures before cleanup may also leave a compressed database dump accessible in /tmp.

Attack Path

1. An attacker with local access determines or predicts when the scheduled backup runs.
2. The attacker calculates the expected timestamp-based filename.
3. The attacker creates the corresponding path in /tmp, potentially as a symbolic link to another target.
4. The backup job runs under an account with greater filesystem or database access.
5. Shell redirection follows the prepared path while writing the database dump.
6. This may overwrite a target writable by the backup account or expose database contents through attacker-controlled temporary-file handling.
7. If upload or cleanup fails, the sensitive backup can remain on local storage.

Impact Assessment

The primary impacts are disclosure of database contents and local file overwrite within the backup account's permissions. A leaked dump may contain user ...[truncated 203 chars]

Remediation

View remediation

Remediation Suggestions

• Set umask 077 before creating backup files.
• Create a private temporary directory with mktemp -d, or create the file atomically with mktemp.
• Quote all variable expansions, including "$DATABASE_URL" and temporary-file paths.
• Add an EXIT trap that securely removes the temporary backup and directory after success or failure.
• Use strict shell error handling, such as set -euo pipefail, and verify that both dump creation and upload succeed.
• Run the backup under a dedicated least-privileged account.
• Prefer streaming the encrypted backup directly to controlled storage where supported, or encrypt it before writing it to disk.
• Ensure remote backup storage has restrictive access controls, retention policies, and encryption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

STRIPE_SECRET_KEY=sk_test_... RESEND_API_KEY=re_...

.env (NEVER committed)

Copy .env.example and fill in real values

text

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

curl -L https://fly.io/install.sh | sh fetches remote code and executes it immediately with no integrity verification, review step, or pinning. If the remote endpoint, network path, or install script is compromised, users of the skill could execute attacker-controlled shell commands on their machines.

Content

Scanner excerpt · references/deployment-guides.md (reported line 59)May include surrounding context.

bash

# Install CLI
curl -L https://fly.io/install.sh | sh

# Launch (creates fly.toml)
fly launch

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping a downloaded script directly into sh creates an unsafe command chain where untrusted network content is executed immediately. This removes any opportunity to inspect or validate the script and increases exposure to supply-chain compromise.

Content

Scanner excerpt · references/deployment-guides.md (reported line 59)May include surrounding context.

bash

# Install CLI
curl -L https://fly.io/install.sh | sh

# Launch (creates fly.toml)
fly launch

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/deployment-guides.md (reported line 88)May include surrounding context.

md

pg_dump $DATABASE_URL | gzip > /tmp/$FILENAME
aws s3 cp /tmp/$FILENAME s3://my-backups/$FILENAME
rm /tmp/$FILENAME

# Keep only last 30 days
aws s3 ls s3://my-backups/ | sort | head -n -30 | awk '{print $4}' | xargs -I {} aws s3 rm s3://my-backups/{}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The command deletes S3 objects derived from a shell pipeline without validation, making it easy for parsing errors or unexpected object names to trigger deletion of unintended backups. Because this is backup retention logic in a deployment guide, misuse directly threatens recoverability and business continuity.

Content

Scanner excerpt · references/deployment-guides.md (reported line 91)May include surrounding context.

rm /tmp/$FILENAME

Keep only last 30 days

aws s3 ls s3://my-backups/ | sort | head -n -30 | awk '{print $4}' | xargs -I {} aws s3 rm s3://my-backups/{}

text

### Test Restore (Monthly)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The aws s3 ls ... | ... | xargs ... aws s3 rm chain automates destructive operations based on text parsing, which is brittle and hard to verify before execution. A small logic error, unexpected listing format, or wrong bucket context could mass-delete backups and eliminate recovery options.

Content

Scanner excerpt · references/deployment-guides.md (reported line 91)May include surrounding context.

rm /tmp/$FILENAME

Keep only last 30 days

aws s3 ls s3://my-backups/ | sort | head -n -30 | awk '{print $4}' | xargs -I {} aws s3 rm s3://my-backups/{}

text

### Test Restore (Monthly)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use the skill when the user mentions broad terms like "deploy" and especially "put this online," and then expands further to "any deployment and infrastructure task." This trigger scope is ambiguous and lacks clear boundaries or exclusion examples, increasing the chance of unintended invocation from ordinary conversation.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/deployment-guides.md (reported line 87)May include surrounding context.

md

FILENAME="backup_${DATE}.sql.gz"

pg_dump $DATABASE_URL | gzip > /tmp/$FILENAME
aws s3 cp /tmp/$FILENAME s3://my-backups/$FILENAME
rm /tmp/$FILENAME

# Keep only last 30 days

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/deployment-guides.md (reported line 98)May include surrounding context.

md

FILENAME="backup_${DATE}.sql.gz"

pg_dump $DATABASE_URL | gzip > /tmp/$FILENAME
aws s3 cp /tmp/$FILENAME s3://my-backups/$FILENAME
rm /tmp/$FILENAME

# Keep only last 30 days

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The S3 pruning pipeline performs permanent deletion of backup objects with no dry-run, no bucket/versioning safeguards, and no warning that a sorting/parsing mistake could delete the wrong backups. In a deployment skill, operators may copy-paste this directly into production workflows, making accidental destructive data loss realistic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The restore instructions write directly to $TEST_DATABASE_URL without emphasizing verification that the target is non-production and isolated. If an operator misconfigures that environment variable, the command can overwrite or corrupt a live database during a supposed test restore.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.