fusionaly-deploy

Pass

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides the user with specific commands to download and execute shell scripts from external sources to perform server hardening and software installation.
  • Evidence: Instructs the user to run ssh root@<ip> 'curl -fsSL https://raw.githubusercontent.com/karloscodes/server-hardener/main/harden.sh -o /tmp/harden.sh && sudo bash /tmp/harden.sh' in SKILL.md.
  • Evidence: Instructs the user to run ssh <user>@<host> 'curl -fsSL https://fusionaly.com/install | sudo bash' in SKILL.md.
  • [COMMAND_EXECUTION]: The skill utilizes several CLI tools to manage remote infrastructure and local configuration.
  • Evidence: Uses hcloud for Hetzner Cloud server provisioning, SSH key management, and location/type listing.
  • Evidence: Uses flarectl for Cloudflare DNS record creation and zone verification.
  • Evidence: Uses ssh with -o StrictHostKeyChecking=no to automate connectivity checks for new servers.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of third-party binaries and scripts required for the deployment process.
  • Evidence: Downloads and installs the hcloud and flarectl CLI tools via brew.
  • Evidence: Fetches scripts from raw.githubusercontent.com and fusionaly.com.
  • [PROMPT_INJECTION]: As the skill ingests data from external API responses (Hetzner and Cloudflare) and tool outputs, it possesses an indirect prompt injection surface.
  • Ingestion points: Output from hcloud, flarectl, and curl headers.
  • Boundary markers: None present.
  • Capability inventory: File system access (SSH keys), network operations, and command execution (hcloud, flarectl, ssh).
  • Sanitization: Includes logic to sanitize domains by replacing dots with dashes for server naming.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 6, 2026, 12:49 AM
Security Audit — agent-trust-hub — fusionaly-deploy