Fly

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:21 PM UTC
• Version: 1.0.0

Overview

This Fly.io helper is coherent, but it includes a pipe-to-shell Linux installer and high-impact cloud operations without enough caution or scoping.

Review the Linux installation step before using this skill. Prefer installing flyctl through a trusted package manager or a verified, pinned release. When using the skill, require explicit confirmation before destroy/delete/unset commands, avoid logging secret values, and treat SSH commands as direct changes to running infrastructure.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:19

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -L https://fly.io/install.sh | sh

Technical Analysis

The Linux installation instructions download a remote script from https://fly.io/install.sh and stream it directly into sh. The -L option also permits redirects. The command does not pin a release, constrain the final redirect destination, verify a cryptographic signature or checksum, or allow the downloaded script to be inspected before execution.

Although the fly.io domain is consistent with the Skill's declared Fly.io management functionality, HTTPS only protects the connection to the resolved endpoint; it does not guarantee that the remotely hosted script is immutable or uncompromised. The effective payload can change after this Skill has been reviewed.

Installing flyctl is necessary for the declared functionality, but executing mutable network content directly through a shell is not the minimum-risk installation method. A compromised origin, publishing pipeline, redirect destination, DNS/TLS trust chain, or upstream installer could turn this instruction into arbitrary command execution.

Attack Path

1. A user or automation agent follows the documented Linux setup procedure.
2. curl requests the remote installer and follows any HTTP redirects.
3. The response body is passed immediately to sh, without being saved or verified.
4. A compromised or malicious response supplies arbitrary shell commands.
5. Those commands execute with all permissions available to the invoking user.
6. The payload could then read or modify accessible files and credentials, alter the development environment, install persistence, or tamper with subsequent deployments.

Impact Assessment

Successful exploitation provides arbitrary command execution unde ...[truncated 589 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | sh installation command.
• Prefer an official operating-system package repository or another package manager that authenticates packages and supports pinned versions.
• If a release artifact must be installed manually:
  1. Pin an explicit flyctl version.
  2. Download the artifact to a local file rather than piping it into a shell.
  3. Restrict redirects to documented, trusted destinations.
  4. Verify the publisher's cryptographic signature or a trusted, version-specific SHA-256 checksum.
  5. Extract or execute the artifact only after verification succeeds.
• Present installation commands to the user and require explicit confirmation before execution.
• Document the files, directories, and permissions the installation is expected to modify.
• Run installation with an unprivileged account unless a narrowly scoped privileged operation is explicitly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to pipe a remotely fetched script directly into a shell, which executes unreviewed code from the network immediately. If the hosting endpoint, transport, DNS, or distribution path is compromised, this can lead to arbitrary code execution on the local machine during installation.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Linux:

bash

curl -L https://fly.io/install.sh | sh

Verify installation:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | sh construct is a classic command-chaining pattern that turns downloaded content into immediate shell execution without validation. In an agent context, this is more dangerous because it normalizes a high-risk execution pattern that could be reused automatically or with attacker-influenced URLs in future workflows.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Linux:

bash

curl -L https://fly.io/install.sh | sh

Verify installation:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file describes destructive operations such as fly apps destroy <name> with no warning about irreversible impact on deployed resources or user data. Under the markdown criteria for missing user warnings, skills should disclose behaviours that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill includes commands for listing, setting, and unsetting secrets, but the markdown provides no warning that these operations involve sensitive credentials and should be handled carefully. This omits a privacy/security disclosure for behaviour that affects confidential data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown advertises opening an SSH console and running remote commands, which can directly alter deployed systems, but it provides no caution about operational risk or user confirmation. For markdown skills, potentially system-affecting behaviour should be disclosed to the user.

Content

No source excerpt is available for this finding.