fly-io
Warn
Audited by Snyk on Mar 7, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill explicitly reads and acts on untrusted, public app content — e.g., the Quick Start/cheat-sheet instructs using "fly logs" to view application logs and the CI workflow includes a smoke-test "curl -f https://my-app-staging.fly.dev/health" — so responses or logs from public/user-generated sources can influence deploy decisions and next actions.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill includes an installation command that fetches and executes remote code at runtime ("curl -L https://fly.io/install.sh | sh"), and flyctl (installed by that URL) is a required runtime dependency for the skill.
Audit Metadata