fusionaly-deploy
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides the user with specific commands to download and execute shell scripts from external sources to perform server hardening and software installation.
- Evidence: Instructs the user to run
ssh root@<ip> 'curl -fsSL https://raw.githubusercontent.com/karloscodes/server-hardener/main/harden.sh -o /tmp/harden.sh && sudo bash /tmp/harden.sh'inSKILL.md. - Evidence: Instructs the user to run
ssh <user>@<host> 'curl -fsSL https://fusionaly.com/install | sudo bash'inSKILL.md. - [COMMAND_EXECUTION]: The skill utilizes several CLI tools to manage remote infrastructure and local configuration.
- Evidence: Uses
hcloudfor Hetzner Cloud server provisioning, SSH key management, and location/type listing. - Evidence: Uses
flarectlfor Cloudflare DNS record creation and zone verification. - Evidence: Uses
sshwith-o StrictHostKeyChecking=noto automate connectivity checks for new servers. - [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of third-party binaries and scripts required for the deployment process.
- Evidence: Downloads and installs the
hcloudandflarectlCLI tools viabrew. - Evidence: Fetches scripts from
raw.githubusercontent.comandfusionaly.com. - [PROMPT_INJECTION]: As the skill ingests data from external API responses (Hetzner and Cloudflare) and tool outputs, it possesses an indirect prompt injection surface.
- Ingestion points: Output from
hcloud,flarectl, andcurlheaders. - Boundary markers: None present.
- Capability inventory: File system access (SSH keys), network operations, and command execution (
hcloud,flarectl,ssh). - Sanitization: Includes logic to sanitize domains by replacing dots with dashes for server naming.
Audit Metadata