Coolify

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:22 AM UTC
• Version: 2.1.1

Overview

This Coolify management skill is mostly purpose-aligned, but it can perform destructive production actions and handle sensitive credentials without enough guardrails.

Review this skill before installing. Use only narrowly scoped Coolify tokens, set COOLIFY_API_URL only to a trusted HTTPS Coolify endpoint, avoid entering private keys or passwords directly in command arguments, and manually confirm database or environment-variable deletes before allowing an agent to run them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:584

Finding

Default SSH Private Key Exposed Through Command-Line Argument Expansion

Content

View full analysis

Remediation

View remediation

` option and read the file internally without printing its contents. 4. Verify that the selected file is a regular file, is owned by the invoking user, and has restrictive permissions such as mode `0600`. 5. Recommend generating a dedicated Coolify deployment key instead of reusing `~/.ssh/id_rsa`. 6. Require explicit user confirmation before reading any private-key file. 7. Avoid returning private-key material in command output or API error messages. 8. Where supported by the API, prefer references to keys already registered in Coolify rather than repeatedly transmitting raw private-key material. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/coolify.sh:8

Finding

Bearer Token and Secret Payloads Can Be Redirected to an Unvalidated API Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/coolify.sh:50

Finding

Sensitive API Response Temporary File Is Not Cleaned Up on Transport Failure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The example reads the user's local SSH private key from ~/.ssh/id_rsa and injects it directly into a command argument. This is dangerous because command-line arguments are often visible to process listings, shell history, agent logs, and telemetry, and it normalizes exfiltration of a highly sensitive credential into a remote platform.

Content

Scanner excerpt · SKILL.md (reported line 588)May include surrounding context.

{baseDir}/scripts/coolify security keys create
--name "Production Key"
--description "SSH key for production servers"
--private-key "$(cat ~/.ssh/id_rsa)"

text

### Update Private Key

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Deleting application environment variables based solely on user-supplied UUIDs enables a high-impact state-changing action with no confirmation, preview, or policy validation. In an agent setting, manipulated or mistaken parameters could remove secrets or configuration and trigger outages, broken deployments, or security regressions.

Content

Scanner excerpt · scripts/coolify.sh (reported line 377)May include surrounding context.

sh

[[ -z "$env_uuid" ]] && { error_response "MissingParameter" "Missing --env-uuid" ""; return 1; }
  
  local response
  response=$(api_call DELETE "/applications/${uuid}/envs/${env_uuid}")
  success_response "$response"
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This endpoint allows direct deletion of a database from a single parameterized call with no guardrails. Because databases are highly sensitive stateful assets, parameter abuse, prompt injection, or simple operator error could lead to permanent data loss and severe availability impact.

Content

Scanner excerpt · scripts/coolify.sh (reported line 527)May include surrounding context.

sh

[[ -z "$uuid" ]] && { error_response "MissingParameter" "Missing --uuid" ""; return 1; }
  
  local response
  response=$(api_call DELETE "/databases/${uuid}")
  success_response "$response"
}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill exposes broad shell-driven operational capabilities but does not declare any tool scope such as allowed-tools or permissions. That increases the chance an agent can invoke arbitrary or overly powerful shell actions through this skill without an explicit sandbox or least-privilege boundary.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

- Deploy applications to Coolify
- Manage application lifecycle (start, stop, restart)
- View application logs
- Create and manage databases (PostgreSQL, MySQL, MongoDB, Redis, etc.)
- Deploy Docker Compose services
- Manage servers and infrastructure
- Configure environment variables

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill encourages handling sensitive material including environment variable secrets, API tokens, SSH private keys, and GitHub App private keys, but provides no warning about redaction, storage, command-history exposure, or log leakage. In agent workflows, these secrets may be echoed, persisted, or included in telemetry and transcripts, creating a real credential exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents destructive actions such as delete operations for databases, servers, projects, services, environments, keys, and apps without requiring confirmation or emphasizing irreversibility. In an agent context, this can lead to accidental or prompt-induced destruction of production resources with little friction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/coolify.sh (reported line 59)May include surrounding context.

sh

temp_file=$(mktemp)
  
  if [[ -n "$data" ]]; then
    http_code=$(curl -s -w "%{http_code}" -o "$temp_file" \
      -X "$method" \
      -H "Authorization: Bearer ${COOLIFY_TOKEN}" \
      -H "Content-Type: application/json" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The database deletion command performs an irreversible DELETE operation immediately after receiving a UUID, with no confirmation prompt, dry-run mode, or additional verification. In an agent/tooling context, a mistaken parameter, prompt injection, or ambiguous user request could cause destructive loss of data and service availability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Multiple database creation commands accept secrets like root passwords and admin passwords via command-line flags, which are commonly exposed through shell history, process listings, audit logs, and agent transcripts. Even though the values are sent over the API intentionally, the local handling method materially increases credential exposure risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description scopes the capability to deployments, applications, databases, and services, but the command router also exposes team, project, and server enumeration endpoints. This creates a capability/expectation mismatch that can lead users or higher-level agents to grant or invoke broader infrastructure-discovery access than intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.