deploy-coolify-cloud

Warn

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: MEDIUMPERSISTENCEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PERSISTENCE]: The scripts/setup-token.sh script modifies the user's shell configuration files (~/.bashrc, ~/.zshrc, or ~/.profile) by appending a command to source the ~/.config/coolify-cloud.env file. This ensures the Coolify API token is persistently available in future shell sessions.
  • [PERSISTENCE]: The references/auto-update.md documentation provides detailed instructions and configuration files for setting up systemd timers (Linux) and launchd agents (macOS). These are used to execute the auto-update-service.sh script on a recurring schedule (e.g., every 30 minutes) to poll for new image versions and redeploy services.
  • [EXTERNAL_DOWNLOADS]: The scripts/install-coolify-cli.sh script downloads the official Coolify CLI binary from the coollabsio/coolify-cli GitHub repository and installs it to the user's local binary directory (~/.local/bin).
  • [COMMAND_EXECUTION]: The skill uses bash, curl, python3, and docker commands to perform its core functions. Notably, references/compose-authoring.md suggests using bash's /dev/tcp redirection feature for container health checks (exec 3<>/dev/tcp/127.0.0.1/<port>), which involves direct network socket interaction from the shell environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by ingesting external, user-provided docker-compose.yml files (via the --compose argument in scripts/deploy-compose.sh). These files are processed and their contents are interpolated into API payloads that trigger remote service deployments and local container operations. While common for deployment tools, this relies on the integrity of the provided compose file to prevent malicious configuration from being executed.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 9, 2026, 10:30 PM