createos

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
7
Flagged
7
Chunks
16
Flagged Files (7)
SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/5] Description: --- name: createos description: "Deploy ANYTHING to production on CreateOS cloud platform. Use this skill when deploying, hosting, or shipping: (1) AI agents and multi-agent systems, (2) Backend APIs and microservices, (3) MCP servers and AI skills, (4) API wrappers and proxy services, (5) Frontend apps and dashboards, (6) Webhooks and automation endpoints, (7) LLM-powered services and RAG pipelines, (8) Discord/Slack/Telegram bots, (9) Cron jobs and scheduled w

Tool: SKILL.md [2/5] Description: | Custom domains, SSL, DNS verification | | **GitHub Integration** | Auto-deploy, branch management, repo access | | **Analytics** | Request metrics, error rates, performance data | | **Security** | Vulnerability scanning, API key management | | **Organization** | Group projects into apps, manage services | ### Technical Skills | Skill | Description | |-------|-------------| | **Authentication** | API key-based auth with expiry management | | **Build AI** | Auto

Tool: SKILL.md [3/5] Description: // since-seconds: look back window (default: 60) ``` **Environment logs** — Aggregate logs for an environment: ```json GetProjectEnvironmentLogs(project_id, environment_id, since-seconds?) ``` --- ## Environment Management Skills ### Skill: Create Environments Environments provide isolated configurations for the same codebase.

Tool: SKILL.md [4/5] Description: | **Note**: Deleting an app sets `appId: null` on associated projects/services (doesn't delete them).

Tool: SKILL.md [5/5]

config/config.jsonHIGH
78.3%

Malicious tool definition detected

Tool: config/config.json Description: { "name": "createos", "version": "0.0.2", "description": "CreateOS Cloud Deployment Platform - Ship anything to production", "mcp": { "endpoint": "https://api-createos.nodeops.network/mcp", "transport": "sse", "authentication": "handled_by_mcp_server", "note": "When using MCP (OpenClaw, Claude, etc.), NO API KEY NEEDED.

references/api-reference.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/api-reference.md [1/2] Description: # CreateOS API Reference Complete API reference for CreateOS cloud deployment platform.

Tool: references/api-reference.md [2/2] Description: Create Domain `POST /v1/projects/{project_id}/domains` **Request Body:** ```json { "name": "api.example.com", "environmentId": "optional-env-uuid" } ``` --- ### List Domains `GET /v1/projects/{project_id}/domains` --- ### Refresh Domain `POST /v1/projects/{project_id}/domains/{domain_id}/refresh` **Note:** Triggers DNS verification.

references/deployment-patterns.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/deployment-patterns.md [1/2] Description: # CreateOS Deployment Patterns Ready-to-use configurations for common deployment scenarios.

Tool: references/deployment-patterns.md [2/2]

scripts/createos.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/createos.py [1/2] Description: #!/usr/bin/env python3 """ CreateOS Python SDK / Deployment Script Usage: from createos import CreateOS client = CreateOS(api_key="your-api-key") project = client.create_project("my-app", "My Application", project_type="upload") deployment = client.upload_files(project["id"], {"index.html": "<h1>Hello</h1>"}) """ import os import json import requests from typing import Optional, Dict, List, Any from dataclasses import dataclass from pathlib import Pat

Tool: scripts/createos.py [2/2]

scripts/deploy.shHIGH
78.3%

Malicious tool definition detected

Tool: scripts/deploy.sh [1/2] Description: #!/bin/bash # # CreateOS Deployment Script # Usage: ./deploy.sh <command> [options] # # Commands: # create-project Create a new project # deploy Trigger deployment # upload Upload files to deploy # status Check deployment status # logs View deployment logs # env-vars Update environment variables # list-projects List all projects # list-deployments List deployments for a project # set -euo pipefail # Configuration API_BASE="${CREATEOS_API_URL:-https://ap

Tool: scripts/deploy.sh [2/2] Description: select(.id==$id)') if [ -z "$current" ]; then log_error "Environment not found: $environment_id" fi local payload payload=$(python3 - "$current" "$env_json" <<'PY' import json import sys env_obj = json.loads(sys.argv[1]) new_pairs = json.loads(sys.argv[2]) run_envs = (env_obj.get('settings') or {}).get('runEnvs') or {} run_envs.update(new_pairs) payload = { 'displayName': env_obj.get('displayName'), 'uniqueName': env_obj.get('uniqueName'), 'description'

scripts/quick-deploy.shHIGH
78.3%

Malicious tool definition detected

Tool: scripts/quick-deploy.sh [1/2] Description: #!/bin/bash # # CreateOS Quick Deploy - One-liner deployment helpers # # Usage: # ./quick-deploy.sh agent <name> <github_repo> Deploy an AI agent # ./quick-deploy.sh mcp <name> <github_repo> Deploy an MCP server # ./quick-deploy.sh api <name> <github_repo> Deploy a FastAPI service # ./quick-deploy.sh bot <name> <image> Deploy a Discord/Slack bot # ./quick-deploy.sh static <name> <directory> Deploy static files # set -euo pipefail API_BASE="${CREAT

Tool: scripts/quick-deploy.sh [2/2]

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
7
Files Flagged
7
Chunks Analyzed
16
Analyzed
Feb 21, 2026, 05:16 AM
Security Audit — runlayer — createos