bootstrap-fly-env-sync
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill creates a local shell script (
scripts/env-to-fly-secrets.sh) based on a provided template and marks it as executable viachmod +x. It also runs the script for initial verification. - [INDIRECT_PROMPT_INJECTION]: The generated script processes content from external
.envfiles. - Ingestion points: The script reads the file specified by the user via the
-fargument (e.g.,SKILL.mddescribes checking for.env.sampleand.env.prod). - Boundary markers: The script implements line-by-line parsing that ignores comments and empty lines.
- Capability inventory: The script is capable of executing
fly secrets setcommands; the skill itself usesmkdir,chmod, andbashfor setup and verification. - Sanitization: The script validates that all keys conform to a strict alphanumeric and underscore format (
^[A-Za-z_][A-Za-z0-9_]*$).
Audit Metadata