📦

yolo

Name: yolo
Author: 10K-Digital

Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Automate Lovable Deployments

Lovable backend deployments can require repeated manual prompts and checks. This skill automates edge function and migration workflows with MCP or browser automation and reports verification results.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "yolo" from https://skillstore.io/skills/10k-digital-yolo.md and its manifest at https://skillstore.io/api/skills/10k-digital-yolo/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/10k-digital-yolo.md Signed manifest GET /api/skills/10k-digital-yolo/manifest Signed lockfile GET /api/skills/10k-digital-yolo/lockfile

Test it

Using "yolo". Deploy the send-email edge function with yolo mode.

Expected outcome:

The skill reports the selected deployment method, sends the Lovable prompt, monitors completion, and lists verification results.

Using "yolo". Apply the new migration after push.

Expected outcome:

The skill detects migration files, submits the migration prompt, and provides a success or fallback summary.

Using "yolo". Yolo mode failed to find the chat input.

Expected outcome:

The skill explains the browser automation failure and gives a manual prompt to copy into Lovable.

Security Audit

High Risk

v7 • 7/9/2026 Open versioned report

Static detections are mostly documentation false positives: Markdown backticks, example URLs, and example secret names are not executable code or leaked credentials. Semantic review found real operational risk because the skill can automate Lovable deployments, migration application, and external prompt submission when enabled.

Files scanned

4,529

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:131-140 SKILL.md:614-624

Autonomous Production Deployment Capability

The skill can automatically detect backend changes after a successful git push to main and trigger deployment automation when auto_deploy is enabled. This can modify deployed edge functions or apply migrations without a fresh per-deployment confirmation.

The documented trigger is a successful git push with backend changes and auto_deploy enabled. The workflow explicitly says automation starts automatically after detecting those changes.

High

SKILL.md:25-27 SKILL.md:124-127

Database Migration Automation

The skill automates Lovable migration application workflows. Applying migrations can alter database schema or data, so this workflow has high operational impact even when used as intended.

The skill explicitly lists /apply-migration as an activation command and describes detecting new supabase/migrations files to generate a migration prompt.

Medium

SKILL.md:40-48 SKILL.md:179-188

External Service Prompt Submission

The skill reads a Lovable project URL, extracts the project ID, and sends generated deployment prompts through Lovable MCP or browser automation. This intentionally transmits project deployment instructions to an external service.

The workflow states that it calls send_message(project_id, prompt) or submits the prompt through the Lovable chat interface. This is expected behavior, but it is still externally visible automation.

Risk Factors

⚙️ External commands (50)

references/automation-workflows.md:64-66 references/automation-workflows.md:693-697 references/automation-workflows.md:1085-1086 references/automation-workflows.md:1114-1115 references/detection-logic.md:141-158 references/detection-logic.md:168-184 references/mcp-workflows.md:49-51 references/mcp-workflows.md:51-52 references/mcp-workflows.md:52-53 references/post-push-automation.md:252-253 references/post-push-automation.md:290-291 references/post-push-automation.md:291-292 references/post-push-automation.md:292-293 references/post-push-automation.md:398-402 references/post-push-automation.md:416-421 SKILL.md:23 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:42 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:54 SKILL.md:56 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:84 SKILL.md:87 SKILL.md:104 SKILL.md:105 SKILL.md:106 SKILL.md:109 SKILL.md:120 SKILL.md:121 SKILL.md:125 SKILL.md:126 SKILL.md:129 SKILL.md:133 SKILL.md:135 SKILL.md:139 SKILL.md:143-157 SKILL.md:157-165 SKILL.md:165-172 SKILL.md:172-173 SKILL.md:173-177 SKILL.md:177-181 SKILL.md:181-196

🌐 Network access (31)

🔑 Env variables (28)

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/10k-digital-yolo/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/10k-digital-yolo/security.svg)](https://skillstore.io/skills/10k-digital-yolo?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/10k-digital-yolo?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/10k-digital-yolo/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/10k-digital-yolo.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

10K-Digital. (2026). yolo security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/10k-digital-yolo/audits/7

BibTeX citation

@techreport{10k-digital-10k-digital-yolo-2026,
  author = {10K-Digital},
  title = {yolo security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/10k-digital-yolo/audits/7},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "yolo security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
  - name: "10K-Digital"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/10k-digital-yolo/audits/7"
identifiers:
  - type: other
    value: "skillstore:10k-digital-yolo:audit:7"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Speed up backend iteration

Deploy changed edge functions from Claude after code is pushed and verify the result.

Automate migration application

Submit migration prompts to Lovable and track success or failure with clear fallback steps.

Standardize deployment checks

Use repeatable verification levels for logs, console errors, and endpoint behavior after deployment.

Try These Prompts

Enable yolo mode

Enable yolo mode for my Lovable project and explain what configuration you will read before deploying.

Deploy an edge function

Use yolo mode to deploy the changed edge function and run the default verification checks.

Apply migrations with verification

Use yolo mode to apply the new Supabase migration, then verify that the deployment completed successfully.

Auto-deploy after push

After this git push succeeds, detect backend changes and use yolo auto-deploy only if the project configuration allows it.

Best Practices

Use MCP mode when possible because it is more stable than browser automation.
Keep yolo testing enabled for deployments that affect production behavior.
Review auto-deploy settings before pushing changes to main.

Avoid

Do not enable auto-deploy for production changes that require manual approval.
Do not rely on browser automation when Lovable login or UI state is unknown.
Do not skip verification for migrations or edge functions with external dependencies.