Fly.io CLI

• Analyzed: May 12, 2026, 3:04 AM
• Findings: 1
• Version: 1.0.3
• Hash: cf496d93499cbf6083c12016681980e32a5ba22eaf5c7126bfa65f4aa3ef96ab
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed with strong safety measures. The `SKILL.md` explicitly instructs the AI agent to default to read-only operations and requires explicit user approval for any state-changing or high-risk commands (e.g., `fly deploy`, `fly ssh console`, `fly secrets set`). The `scripts/fly_app_from_toml.sh` is a simple, local bash script to parse `fly.toml` for an app name, which is a benign utility function. There is no evidence of data exfiltration, malicious execution, persistence, prompt injection attempts to bypass safety, or obfuscation.