coolify-compose
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a transformation guide and template library for Coolify deployments. It does not execute arbitrary code or scripts on the host environment; all logic pertains to generating YAML configuration files.
- [SAFE]: External URLs reference official documentation and public repositories for established services, including Coolify, Ghost CMS, Plausible Analytics, and Uptime Kuma.
- [SAFE]: Hardcoded credentials present in the
examples/directory (such aspassword123orsupersecretpasswordinbefore.ymlfiles) are explicitly provided as illustrative examples of insecure patterns that users should replace. They are not used by the skill for authentication and do not represent a credential exposure risk. - [SAFE]: Network operations mentioned in the documentation, such as
curlandwget, are exclusively used within Dockerhealthcheckdefinitions. These commands are executed within the user's isolated container environment at runtime and do not interact with the agent's host or sensitive data. - [SAFE]: The skill's primary function is a static data transformation (YAML to YAML). While it ingests user-provided compose files, it does not incorporate capabilities that would allow for the exploitation of indirect prompt injection or arbitrary code execution during the conversion process.
Audit Metadata