flyio-upgrade-migration
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes a command to reinstall the Fly.io CLI via
curl -L https://fly.io/install.sh | sh. This command downloads and executes a script from the officialfly.iodomain, which is the established domain for this well-known cloud service. - [EXTERNAL_DOWNLOADS]: The skill references an installation script hosted at
fly.io. This is a well-known technology provider, and the reference is consistent with official installation procedures. - [DATA_EXFILTRATION]: The skill contains explicit instructions to ensure that sensitive information, such as authentication tokens and database connection strings, are excluded from migration receipts to prevent accidental exposure.
- [INDIRECT_PROMPT_INJECTION]: The skill involves reading output from CLI tools like
fly statusto inform migration steps. While this represents an ingestion point for external data, the risk is minimal as it processes structured output from an authenticated CLI tool to perform standard administrative tasks.
Audit Metadata