coolify-ops
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/install-cli.shdownloads the official Coolify CLI installation script from GitHub (https://raw.githubusercontent.com/coollabsio/coolify-cli/main/scripts/install.sh) and executes it using bash. This is the documented and official method for installing the tool managed by this skill. - [COMMAND_EXECUTION]: The skill operates by executing shell commands via the
coolifyCLI. It includes scripts likescripts/doctor.sh,scripts/health-check.sh, andscripts/deploy-and-watch.shwhich wrap CLI calls to provide the agent with structured feedback on resource status and deployment logs. - [PROMPT_INJECTION]: The skill contains defensive instructions in
SKILL.mdandreferences/safety-rules.mdthat define 'red lines' for the agent. These instructions explicitly forbid the agent from performing destructive actions (like deleting databases or stopping production services) without explicit user confirmation and prevent the agent from adding flags that skip these confirmations (e.g.,--forceor-f). - [DATA_EXFILTRATION]: While the skill manages sensitive Coolify API tokens, it includes strict instructions to the agent to never reveal these tokens in chat responses, never copy the CLI's configuration file (
~/.config/coolify/config.json), and to redact sensitive information surfaced during troubleshooting unless specifically required by the user.
Audit Metadata