coolify
Fail
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides an installation command for the Coolify CLI that fetches a script from a remote URL and pipes it directly into the bash interpreter (
curl -fsSL https://raw.githubusercontent.com/coollabsio/coolify-cli/main/scripts/install.sh | bash). This pattern is high-risk as it allows a remote server to execute arbitrary, unverified code on the host machine without a validation or review step. - [COMMAND_EXECUTION]: The skill includes a bundled shell script (
scripts/coolify-preflight.sh) and instructions to run various local CLI commands. While intended for diagnostics, the execution of thecoolify configcommand may potentially output sensitive configuration details to the agent's log context depending on the CLI's implementation.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/coollabsio/coolify-cli/main/scripts/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata