Security audit
Security checks across malware telemetry and agentic risk
This skill is a transparent Fly.io helper that defaults to read-only checks and clearly requires user approval before changing cloud resources.
Install this only if you want an agent to help operate Fly.io resources. Before approving any deploy, SSH command, secret change, scaling action, volume, database, or app-destroy operation, confirm the target app, account, command, and expected impact; keep FLY_API_TOKEN protected and least-privileged where possible.
## High-risk operations (ask first) These commands can execute arbitrary code on servers or mutate production state. Only run them when the user explicitly asks you to. - Deploy:
- Prefer **read-only** commands first: `fly status`, `fly logs`, `fly config show`, `fly releases`, `fly secrets list`. - **Do not edit/modify Fly.io apps, machines, secrets, volumes, or databases without your human’s explicit approval.** - Read-only actions are OK without approval. - Destructive actions (destroy/drop) always require explicit approval. - When debugging builds, capture the exact error output and determine whether it’s a: - build/packaging issue (Dockerfile, Gemfile.lock platforms, assets precompile)
# Safety policy - Read-only Fly.io actions are allowed without asking. - Any action that edits/modifies Fly.io state requires your human’s explicit approval. - Examples: deploys, scaling, secrets set/unset, volume/db create/drop, app destroy.
66/66 vendors flagged this skill as clean.
No suspicious patterns detected.
