Is coolify-deploy safe to install?

SaferSkills independently audited coolify-deploy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/coolify-deploy/SKILL.md · 1 file

skills/coolify-deploy/SKILL.md1.6 KB · Markdown

name: coolify-deploy

description: Deploy, restart, or check status of any application or service on the Coolify VPS. Lists all deployable resources, triggers deploys, tails logs, and confirms the container comes up healthy. Use when deploying a new version, restarting a service, checking deploy status, or reading deployment logs. Triggers on "deploy", "restart service", "push to production", "deploy to vps", "check deploy status", "deployment logs", "is it deployed".

argument-hint: <service-name> - partial name is fine, will fuzzy match

compatibility: Requires COOLIFY_API_BASE and COOLIFY_API_TOKEN in ~/.secrets/master.env.

allowed-tools: Bash Read

disable_model_invocation: true

Coolify Deploy

Triggers and monitors deployments on the Coolify VPS via the REST API.

Arguments

Service to deploy: $ARGUMENTS

Step 1 - Run

If no argument was given, list all deployable services and ask the user which one:

~/.claude/commands/coolify-deploy/scripts/deploy.sh list

If a service name was given:

~/.claude/commands/coolify-deploy/scripts/deploy.sh deploy "$ARGUMENTS"

Step 2 - Report

For list: show a clean table of all applications and services with their current status. Let the user pick one.

For deploy:

Confirm which service was matched (name + UUID)
Report deploy triggered
Show the status polling output until the deploy completes or fails
If it fails, show the last 20 lines of logs so the user knows why
If it succeeds, confirm the service is healthy

One clear outcome: deployed and healthy, or failed with reason.

coolify-deploy— agent skill

Is coolify-deploy safe to install?

Coolify Deploy

Arguments

Step 1 - Run

Step 2 - Report

Audit the pieces. Scan the whole. Decide.