Devops Deploy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 1.0.0

Overview

This deployment skill is coherent, but it includes copy-paste commands that can run unverified remote installers and delete backups without safeguards.

Review the deployment commands before installing or using this skill. Do not let an agent run the Fly.io pipe-to-shell installer, unpinned global CLI installs, S3 backup deletion, or database restore commands without explicit confirmation and safer checks such as pinned versions, verified installers, private temporary files, dry-run deletion, and verified non-production restore targets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/deployment-guides.md:59
• Finding: Unverified Remote Installer Executed Directly by a Shell## Vulnerability Details **File Location**: `references/deployment-guides.md`, line 59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -L https://fly.io/install.sh | sh ``` ### Technical Analysis The command streams mutable content from an external endpoint directly into `sh`. It follows redirects and provides no version pinning, cryptographic checksum verification, signature validation, or opportunity to inspect the downloaded script before execution. Installing the Fly.io CLI supports the Skill's stated deployment functionality, but executing an unverified remote script is not the minimum capability necessary to perform that task. The effective payload can change after the Skill has been reviewed. Compromise of the hosting endpoint, redirect chain, DNS or TLS trust path, or upstream publishing process would allow attacker-controlled shell commands to run with the invoking user's privileges. ### Attack Path 1. A user requests assistance deploying an application through Fly.io. 2. The agent follows the referenced deployment guide and recommends or executes the installation command. 3. `curl` retrieves the current content from the remote endpoint and follows any redirects. 4. The downloaded content is passed directly to `sh` without verification. 5. If the remote content or delivery path has been compromised, attacker-supplied commands execute immediately. 6. Those commands can access files, credentials, environment variables, and services available to the invoking account. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the command. Depending on that account's access, an attacker could steal deployment credentials, cloud tokens, SSH keys, source code, and environment secrets; alter local files; tamper with deployment artifacts; or establish persistence. The immediate scope is the invoking acco ...[truncated 61 chars]
• Remediation: ## Remediation Suggestions - Do not pipe network responses directly into a command interpreter. - Prefer an official package manager or a version-pinned release artifact from a verified publisher. - Download the artifact to a local file as a separate step. - Verify a publisher-provided cryptographic checksum and, where available, a release signature. - Inspect the installer before executing it. - Run installation with an unprivileged account and avoid `sudo` unless a specific filesystem operation requires it. - Pin the documented CLI version so future remote changes do not silently alter the reviewed installation process.

T08 · Insecure Dependencies

Warning

• Location: references/deployment-guides.md:6
• Finding: Unpinned Global Installation of Deployment CLI Packages## Vulnerability Details **File Location**: `references/deployment-guides.md`, lines 6 and 31 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ```bash npm i -g vercel npm i -g @railway/cli ``` ### Technical Analysis These commands install mutable latest versions of third-party packages globally. No reviewed version is pinned, and the instructions do not establish lockfile-based reproducibility or an independent integrity-verification procedure. npm packages may execute lifecycle scripts during installation, while global installation places their executable commands into the user's wider environment. The packages are relevant to the declared deployment functionality and there is no evidence that the named packages are intentionally malicious. The risk arises from trusting mutable package versions and their transitive dependency chains. A compromised publisher account, registry incident, malicious future release, or dependency-chain compromise could introduce code that executes during installation or when the globally installed CLI is invoked. ### Attack Path 1. A user follows the Vercel or Railway setup instructions. 2. npm resolves the package name to the registry's current release rather than a reviewed version. 3. npm downloads the package and its transitive dependencies. 4. Installation lifecycle code, if present, runs with the user's privileges. 5. A compromised release can access the user's files and environment or install a modified global executable. 6. The modified CLI may execute again during later deployment operations, potentially gaining access to deployment credentials and application configuration. ### Impact Assessment Exploitation could result in arbitrary code execution under the installing account, theft of local or deployment credentials, tampering with source code and build artifacts, or replacement of globally available CLI commands. The affected scope i ...[truncated 129 chars]
• Remediation: ## Remediation Suggestions - Pin each CLI to a reviewed exact version rather than implicitly installing `latest`. - Prefer project-local or isolated ephemeral installation over global installation where practical. - Preserve lockfile and registry integrity metadata when the installation model supports it. - Use only the expected trusted npm registry and verify package publisher and provenance information. - Disable lifecycle scripts when they are not required and test that the CLI remains functional. - Establish a controlled update process that reviews release notes, provenance, and integrity before changing pinned versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/deployment-guides.md:74
• Finding: Database Backup Written to a Predictable Shared Temporary Path## Vulnerability Details **File Location**: `references/deployment-guides.md`, lines 74–78 **Vulnerability Type**: Unsafe temporary-file handling of sensitive data **Risk Level**: Medium ```bash DATE=$(date +%Y%m%d_%H%M%S) FILENAME="backup_${DATE}.sql.gz" pg_dump $DATABASE_URL | gzip > /tmp/$FILENAME aws s3 cp /tmp/$FILENAME s3://my-backups/$FILENAME ``` ### Technical Analysis The backup filename is derived from a predictable timestamp and is created beneath the shared `/tmp` directory through ordinary shell redirection. The script does not use an atomic secure temporary-file operation, reject symbolic links, create a private directory, or establish a restrictive `umask`. Variable expansions are also unquoted. On a multi-user system, another local user may be able to predict the filename and pre-create it as a symbolic link. When a more privileged backup process opens the path for output, the shell can follow that link and overwrite another file writable by the backup account. Default permissions or failures before cleanup may also leave a compressed database dump accessible in `/tmp`. ### Attack Path 1. An attacker with local access determines or predicts when the scheduled backup runs. 2. The attacker calculates the expected timestamp-based filename. 3. The attacker creates the corresponding path in `/tmp`, potentially as a symbolic link to another target. 4. The backup job runs under an account with greater filesystem or database access. 5. Shell redirection follows the prepared path while writing the database dump. 6. This may overwrite a target writable by the backup account or expose database contents through attacker-controlled temporary-file handling. 7. If upload or cleanup fails, the sensitive backup can remain on local storage. ### Impact Assessment The primary impacts are disclosure of database contents and local file overwrite within the backup account's permissions. A leaked dump may contain user ...[truncated 203 chars]
• Remediation: ## Remediation Suggestions - Set `umask 077` before creating backup files. - Create a private temporary directory with `mktemp -d`, or create the file atomically with `mktemp`. - Quote all variable expansions, including `"$DATABASE_URL"` and temporary-file paths. - Add an `EXIT` trap that securely removes the temporary backup and directory after success or failure. - Use strict shell error handling, such as `set -euo pipefail`, and verify that both dump creation and upload succeed. - Run the backup under a dedicated least-privileged account. - Prefer streaming the encrypted backup directly to controlled storage where supported, or encrypt it before writing it to disk. - Ensure remote backup storage has restrictive access controls, retention policies, and encryption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Credential Access

High

• Category: Privilege Escalation

Content

STRIPE_SECRET_KEY=sk_test_...
RESEND_API_KEY=re_...

# .env (NEVER committed)
# Copy .env.example and fill in real values
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Install CLI
curl -L https://fly.io/install.sh | sh

# Launch (creates fly.toml)
fly launch

• Confidence: 98% confidence
• Finding: `curl -L https://fly.io/install.sh | sh` fetches remote code and executes it immediately with no integrity verification, review step, or pinning. If the remote endpoint, network path, or install script is compromised, users of the skill could execute attacker-controlled shell commands on their machines.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install CLI
curl -L https://fly.io/install.sh | sh

# Launch (creates fly.toml)
fly launch

• Confidence: 98% confidence
• Finding: Piping a downloaded script directly into `sh` creates an unsafe command chain where untrusted network content is executed immediately. This removes any opportunity to inspect or validate the script and increases exposure to supply-chain compromise.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

pg_dump $DATABASE_URL | gzip > /tmp/$FILENAME
aws s3 cp /tmp/$FILENAME s3://my-backups/$FILENAME
rm /tmp/$FILENAME

# Keep only last 30 days
aws s3 ls s3://my-backups/ | sort | head -n -30 | awk '{print $4}' | xargs -I {} aws s3 rm s3://my-backups/{}

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm /tmp/$FILENAME

# Keep only last 30 days
aws s3 ls s3://my-backups/ | sort | head -n -30 | awk '{print $4}' | xargs -I {} aws s3 rm s3://my-backups/{}
```

### Test Restore (Monthly)

• Confidence: 97% confidence
• Finding: The command deletes S3 objects derived from a shell pipeline without validation, making it easy for parsing errors or unexpected object names to trigger deletion of unintended backups. Because this is backup retention logic in a deployment guide, misuse directly threatens recoverability and business continuity.

Chaining Abuse

High

• Category: Tool Misuse

Content

rm /tmp/$FILENAME

# Keep only last 30 days
aws s3 ls s3://my-backups/ | sort | head -n -30 | awk '{print $4}' | xargs -I {} aws s3 rm s3://my-backups/{}
```

### Test Restore (Monthly)

• Confidence: 96% confidence
• Finding: The `aws s3 ls ... | ... | xargs ... aws s3 rm` chain automates destructive operations based on text parsing, which is brittle and hard to verify before execution. A small logic error, unexpected listing format, or wrong bucket context could mass-delete backups and eliminate recovery options.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use the skill when the user mentions broad terms like "deploy" and especially "put this online," and then expands further to "any deployment and infrastructure task." This trigger scope is ambiguous and lacks clear boundaries or exclusion examples, increasing the chance of unintended invocation from ordinary conversation.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

FILENAME="backup_${DATE}.sql.gz"

pg_dump $DATABASE_URL | gzip > /tmp/$FILENAME
aws s3 cp /tmp/$FILENAME s3://my-backups/$FILENAME
rm /tmp/$FILENAME

# Keep only last 30 days

• Confidence: 60% confidence
• Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

FILENAME="backup_${DATE}.sql.gz"

pg_dump $DATABASE_URL | gzip > /tmp/$FILENAME
aws s3 cp /tmp/$FILENAME s3://my-backups/$FILENAME
rm /tmp/$FILENAME

# Keep only last 30 days

• Confidence: 60% confidence
• Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The S3 pruning pipeline performs permanent deletion of backup objects with no dry-run, no bucket/versioning safeguards, and no warning that a sorting/parsing mistake could delete the wrong backups. In a deployment skill, operators may copy-paste this directly into production workflows, making accidental destructive data loss realistic.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The restore instructions write directly to `$TEST_DATABASE_URL` without emphasizing verification that the target is non-production and isolated. If an operator misconfigures that environment variable, the command can overwrite or corrupt a live database during a supposed test restore.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Static analysis

No suspicious patterns detected.