setup

SUSPICIOUS. The skill’s capabilities mostly match its stated Coolify bootstrap purpose, and there is no clear exfiltration or hidden behavior. The main concerns are transitive skill installation and reliance on an unpinned third-party MCP package that receives a privileged Coolify token; this is coherent but expands the trust boundary beyond official Coolify tooling.

The fragment is deployment documentation rather than malware. It contains no apparent malicious code, credential theft, persistence, or covert network exfiltration. It does present a meaningful security risk by instructing operators to expose Coolify and GitHub App endpoints over plaintext HTTP on a public IP and to modify firewall access manually. HTTPS, authenticated webhook validation, least-privilege firewall rules, and secure token handling should be verified in the surrounding configuration and implementation.

The configuration itself does not demonstrate malware, but it creates a supply-chain and credential-exposure risk by automatically executing the unpinned @masonator/coolify-mcp@latest npm package and providing it with a Coolify access token. Pin a reviewed package version or integrity hash, review the package source and permissions, and use a narrowly scoped token.