flyio-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides secure boilerplate for Fly.io applications, implementing defense-in-depth measures such as timing-safe comparisons for webhook verification and automated redaction for sensitive logs.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for ingesting untrusted deployment configuration data via the
validateDeployConfigfunction. - Ingestion points: The
validateDeployConfigfunction inSKILL.mdhandles external input for application deployment parameters. - Boundary markers: None explicitly defined for delimiters, though the skill operates on structured data.
- Capability inventory: The skill has access to
Write,Edit, andBash(fly:*)tools. - Sanitization: Robust validation is implemented using a Zod schema with strict regular expressions for app names and container images to prevent injection or invalid configurations.
Audit Metadata