Quick Deploy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:24 AM UTC
• Version: 1.0.0

Overview

This deployment skill is purpose-aligned, but it can install mutable external deployment tools and run a remote shell installer before deploying real projects.

Review this skill before installing. It is not clearly malicious, but use it only if you are comfortable with an agent installing deployment CLIs globally and running a Fly.io remote installer. Prefer manually installing trusted, pinned CLIs first, and require explicit confirmation for any deployment target and environment.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:80
• Finding: Unverified Remote Installer Executed Through a Shell Pipeline<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 80 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Check if fly CLI is installed which fly || curl -L https://fly.io/install.sh | sh ``` ### Technical Analysis When the `fly` executable is unavailable, this instruction downloads the current contents of `https://fly.io/install.sh` and pipes them directly into `sh`. The downloaded payload is not version-pinned, cryptographically verified, stored for inspection, or reviewed before execution. Although the URL uses HTTPS and refers to Fly.io's declared domain, the effective installer is external to the audited project and can change after the Skill has been reviewed. HTTPS protects transport under ordinary conditions, but it does not protect against compromise of the upstream server, publication process, domain, or installer itself. Installing a deployment CLI is related to the Skill's declared purpose, but immediate execution of mutable remote code exceeds the minimum privilege and trust necessary to perform that installation. ### Attack Path 1. A user asks the Agent to deploy a project to Fly.io. 2. The Agent follows the Skill instructions and checks for the `fly` executable. 3. The executable is not present, causing the fallback command to run. 4. The Agent retrieves the current remote installer from `fly.io`. 5. The response body is passed directly to `sh` without validation. 6. If the upstream source or delivery chain has been compromised, attacker-controlled shell commands execute with the privileges of the Agent process. ### Impact Assessment A malicious installer could execute arbitrary commands under the Agent user's account. Depending on that account's existing permissions, it could read or modify accessible project files, source code, deployment configuration, environment variables, authentication material, and user-level configuration. It could also invoke avai ...[truncated 360 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | sh` installation pattern. 2. Require explicit user approval before installing any new system or user-level tool. 3. Download a specific, reviewed Fly CLI release rather than a mutable installer endpoint. 4. Pin the expected version and verify a vendor-published cryptographic checksum or signature before execution. 5. Store the downloaded artifact temporarily so its source, type, permissions, and digest can be validated. 6. Prefer an official package manager or a documented release binary installed into an isolated, user-controlled directory. 7. Run installation and deployment under a dedicated least-privileged account or isolated environment. 8. If verification cannot be completed, stop and provide manual installation instructions rather than executing the payload. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:56
• Finding: Unpinned Global Installation of Deployment CLI Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 56 and 69 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Check if vercel CLI is installed which vercel || npm install -g vercel ``` ```bash # Check if netlify CLI is installed which netlify || npm install -g netlify-cli ``` ### Technical Analysis These instructions install the latest registry versions of `vercel` and `netlify-cli` globally whenever the corresponding executable is absent. No exact version, lockfile, package integrity value, provenance requirement, or independent signature verification is specified. An npm installation can execute package lifecycle scripts with the privileges of the npm process. Resolving an unpinned latest release means the effective code can change after this Skill has been audited. The package names are consistent with the declared deployment providers, and there is no evidence of intentional typosquatting in the Skill; nevertheless, compromise of a package, maintainer account, registry release, or transitive dependency could introduce malicious code. The `-g` option also modifies the user's global npm environment instead of limiting dependencies to the project or an isolated execution context. Automatic global installation therefore exceeds the minimum scope needed to invoke a deployment client. ### Attack Path 1. A user requests deployment through Vercel or Netlify. 2. The Agent checks for the relevant CLI and finds that it is not installed. 3. The fallback command requests the mutable latest package release from the npm registry. 4. npm downloads the package and its transitive dependencies. 5. Installation or lifecycle scripts execute with the current npm process privileges. 6. A compromised release or dependency can run attacker-controlled code and modify the global npm environment. ### Impact Assessment Malicious dependency code could access files, environment variabl ...[truncated 548 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user approval before installing either CLI. 2. Pin each CLI to a reviewed exact version rather than implicitly installing the latest release. 3. Verify package integrity and provenance using trusted registry metadata or vendor-published signatures. 4. Prefer project-local installation with a committed lockfile instead of global installation. 5. Run the CLI through an isolated environment with restricted filesystem, credential, and network access. 6. Disable lifecycle scripts during installation where supported and compatible, then review any required scripts separately. 7. Separate installation from deployment so package installation cannot occur implicitly as a side effect of a deployment request. 8. Periodically review and intentionally update the pinned versions after security assessment. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

External Script Fetching

High

• Category: Supply Chain

Content

### Fly.io
```bash
# Check if fly CLI is installed
which fly || curl -L https://fly.io/install.sh | sh

# If no fly.toml, launch new app
fly launch --yes --no-deploy

• Confidence: 99% confidence
• Finding: Piping a remote script directly into the shell executes unverified code from the network with the current user's privileges. If the remote server, transport, or script is compromised, this can result in arbitrary code execution, credential theft, persistence, or modification of the local environment used for deployment.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Fly.io
```bash
# Check if fly CLI is installed
which fly || curl -L https://fly.io/install.sh | sh

# If no fly.toml, launch new app
fly launch --yes --no-deploy

• Confidence: 99% confidence
• Finding: The `| sh` construct is a dangerous command-chaining pattern because it turns downloaded content into immediate shell input without validation. In this deployment skill, that risk is amplified because the command may run automatically during tool setup, enabling pre-deployment compromise of the host and any deployment credentials accessible to the CLI.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad phrases such as "ship it" and "go live," which can cause the deploy skill to activate in contexts where the user did not intend an actual deployment action. In a skill that can perform real production-affecting operations, ambiguous activation increases the chance of unintended deployments or follow-on execution of risky commands.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The core behavior says to act when the user says generic words like "deploy" or "ship," which is overly permissive for a capability that can change external infrastructure. Because this skill performs operational actions, ambiguous activation is more dangerous than in a read-only skill and can lead to accidental deployments or unauthorized state changes if invoked by loosely matching user text.

Static analysis

No suspicious patterns detected.