coolify-compose

Pass

Audited by Gen Agent Trust Hub on Apr 1, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a transformation guide and template library for Coolify deployments. It does not execute arbitrary code or scripts on the host environment; all logic pertains to generating YAML configuration files.
  • [SAFE]: External URLs reference official documentation and public repositories for established services, including Coolify, Ghost CMS, Plausible Analytics, and Uptime Kuma.
  • [SAFE]: Hardcoded credentials present in the examples/ directory (such as password123 or supersecretpassword in before.yml files) are explicitly provided as illustrative examples of insecure patterns that users should replace. They are not used by the skill for authentication and do not represent a credential exposure risk.
  • [SAFE]: Network operations mentioned in the documentation, such as curl and wget, are exclusively used within Docker healthcheck definitions. These commands are executed within the user's isolated container environment at runtime and do not interact with the agent's host or sensitive data.
  • [SAFE]: The skill's primary function is a static data transformation (YAML to YAML). While it ingests user-provided compose files, it does not incorporate capabilities that would allow for the exploitation of indirect prompt injection or arbitrary code execution during the conversion process.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 1, 2026, 03:08 PM