coolify-ops

Pass

Audited by Gen Agent Trust Hub on Jun 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/install-cli.sh downloads the official Coolify CLI installation script from GitHub (https://raw.githubusercontent.com/coollabsio/coolify-cli/main/scripts/install.sh) and executes it using bash. This is the documented and official method for installing the tool managed by this skill.
  • [COMMAND_EXECUTION]: The skill operates by executing shell commands via the coolify CLI. It includes scripts like scripts/doctor.sh, scripts/health-check.sh, and scripts/deploy-and-watch.sh which wrap CLI calls to provide the agent with structured feedback on resource status and deployment logs.
  • [PROMPT_INJECTION]: The skill contains defensive instructions in SKILL.md and references/safety-rules.md that define 'red lines' for the agent. These instructions explicitly forbid the agent from performing destructive actions (like deleting databases or stopping production services) without explicit user confirmation and prevent the agent from adding flags that skip these confirmations (e.g., --force or -f).
  • [DATA_EXFILTRATION]: While the skill manages sensitive Coolify API tokens, it includes strict instructions to the agent to never reveal these tokens in chat responses, never copy the CLI's configuration file (~/.config/coolify/config.json), and to redact sensitive information surfaced during troubleshooting unless specifically required by the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 25, 2026, 01:56 PM