fusionaly-deploy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent/user to paste API tokens and embed them verbatim into CLI commands and persistent files (e.g., hcloud --token , export CF_API_TOKEN="..."), which requires the LLM to handle and output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Two URLs point to executable shell installers hosted on non-official sources — a project site (fusionaly.com/install) and a raw GitHub script (raw.githubusercontent.com/.../harden.sh) that the guide instructs users to curl and execute, which is a high-risk pattern for malware distribution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs the operator to fetch-and-execute remote scripts at runtime (curl -fsSL https://raw.githubusercontent.com/karloscodes/server-hardener/main/harden.sh ... && sudo bash and ssh ... 'curl -fsSL https://fusionaly.com/install | sudo bash'), so these URLs directly deliver and execute code during runtime: https://raw.githubusercontent.com/karloscodes/server-hardener/main/harden.sh and https://fusionaly.com/install.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs running privileged installer/hardener scripts (uses sudo, curl|sudo bash), and the hardener creates an admin user and changes SSH/root settings — actions that modify system state and require elevated privileges.