T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:95- Finding
Unverified Remote Docker Installation Script Executed Directly by a Privileged Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Self-Hosting Mastery
Security checks for vulnerabilities and agentic risk
Overview
This self-hosting guide is mostly coherent, but it includes high-impact infrastructure commands that deserve review before an agent follows them.
Install only if you want an agent to provide self-hosting and homelab administration guidance. Before running any generated commands, review them manually, avoid curl-to-shell installers, prefer HTTPS and signed repositories, preview package upgrades, pin container images, and be especially careful with Watchtower or any container that receives Docker socket access.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:87- Finding
System Package Repository Configured over Plaintext HTTP
- Content
View full analysis
/etc/apt/sources.list.d/pve-no-subscription.list apt update && apt upgrade -y ``` ### Technical Analysis The instructions disable the existing Proxmox enterprise repository, create a system-wide replacement repository using plaintext HTTP, and immediately perform an unpinned full package upgrade. APT package and repository signatures materially limit an on-path attacker's ability to substitute arbitrary packages: an attacker without a trusted repository signing key should not be able to produce valid malicious package metadata. Nevertheless, HTTP does not provide transport confidentiality or endpoint authentication. An on-path attacker may observe requests, block or replay traffic within the constraints of APT's metadata validation, cause denial of service, or attempt downgrade and stale-metadata scenarios where repository and client protections permit them. The broad `apt upgrade -y` operation also accepts all currently offered upgrades without an explicit version plan or interactive review, reducing reproducibility and increasing exposure to upstream supply-chain or compatibility failures. ### Attack Path 1. A user or agent executes the setup commands with administrative privileges. 2. The commands modify files under `/etc/apt/sources.list.d/`, affecting future system package operations. 3. APT contacts the configured Proxmox repository over plaintext HTTP. 4. An attacker positioned on the network path can inspect, block, redirect, or replay repository traffic. 5. Valid signature checks should reject unsigned modifications, but the attacker may still disrupt updates or attempt stale or downgrade delivery subject to APT's ...[truncated 1218 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (18)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
curl ... | shis particularly dangerous because it combines network retrieval and immediate shell execution, eliminating any review or verification step. If the remote endpoint, transport, DNS, or upstream supply chain is compromised, arbitrary commands run with the privileges of the user executing the command, which in this setup is likely root inside a container or host environment.- Content
md # Create CT: 2 cores, 2GB RAM, 32GB disk, bridge vmbr0 # Inside CT: install Docker apt install -y curl curl -fsSL https://get.docker.com | sh # 3. Enable IOMMU for GPU passthrough (if needed) # Edit /etc/default/grub: GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md /opt/stacks/ # or ~/docker/ ├── traefik/ │ ├── docker-compose.yml │ ├── .env │ ├── config/ │ │ └── traefik.yml │ └── data/
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md /opt/stacks/ # or ~/docker/ ├── traefik/ │ ├── docker-compose.yml │ ├── .env │ ├── config/ │ │ └── traefik.yml │ └── data/
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md /opt/stacks/ # or ~/docker/ ├── traefik/ │ ├── docker-compose.yml │ ├── .env │ ├── config/ │ │ └── traefik.yml │ └── data/
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md /opt/stacks/ # or ~/docker/ ├── traefik/ │ ├── docker-compose.yml │ ├── .env │ ├── config/ │ │ └── traefik.yml │ └── data/
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md /opt/stacks/ # or ~/docker/ ├── traefik/ │ ├── docker-compose.yml │ ├── .env │ ├── config/ │ │ └── traefik.yml │ └── data/
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md /opt/stacks/ # or ~/docker/ ├── traefik/ │ ├── docker-compose.yml │ ├── .env │ ├── config/ │ │ └── traefik.yml │ └── data/
Docker Socket Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Mounting
/var/run/docker.sockinto a container gives that container effective control over the Docker daemon, which typically equates to root-level control of the host. In this skill, the socket is given to Watchtower for convenience, but if that container or its supply chain is compromised an attacker can start privileged containers, mount the host filesystem, or execute arbitrary code on the server.- Content
md container_name: watchtower restart: unless-stopped volumes: - /var/run/docker.sock:/var/run/docker.sock environment: - WATCHTOWER_SCHEDULE=0 0 4 * * MON # Monday 4 AM - WATCHTOWER_CLEANUP=true
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description defines an expansive scope covering many common infrastructure and backup activities, making accidental invocation more likely. In an agent ecosystem, ambiguous activation can route sensitive system-administration conversations into a skill that contains privileged commands and deployment steps the user may not have intended to invoke.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md │ ├── config/ │ │ └── traefik.yml │ └── data/ │ ├── acme.json # chmod 600 │ └── dynamic/ ├── monitoring/ │ ├── docker-compose.yml
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
log "Backup complete. Total size: $BACKUP_SIZE"
8. Send notification (optional)
curl -s "https://ntfy.sh/my-backups" -d "Backup complete: $BACKUP_SIZE"
text ### Backup Schedule
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # 2. Install fail2ban apt install fail2ban -y systemctl enable fail2ban # 3. Automatic security updates apt install unattended-upgrades -y
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
dpkg-reconfigure -plow unattended-upgrades
4. Disable unused services
systemctl list-unit-files --state=enabled
Disable anything you don't need
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
├── Is the port exposed? (
docker port <name>) → No → Check compose ports/networks ├── Is Traefik routing? (Check Traefik dashboard) → No → Check labels, network ├── Is DNS resolving? (dig app.example.com) → No → Check DNS provider └── SSL error? → Check acme.json permissions (chmod 600), cert resolver logstext ### Docker Debug Commands
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
These configuration examples impose a specific language and locale in natural-language-facing settings, which can conflict with organizational language/locale choice policies when presented as defaults in a skill. The file does not indicate that these are merely placeholders to be replaced based on user preference or region.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are very broad and overlap with common administrator requests, so the skill may activate in many contexts where the user did not explicitly ask for this skill. Over-broad activation increases the chance of unrequested operational guidance being injected into unrelated workflows, which is a prompt-scope security and safety issue for agent systems.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Fetching and executing a remote installation script from
get.docker.comcreates a supply-chain risk because the script is not reviewed, pinned, or integrity-verified before execution. In a self-hosting skill aimed at production-grade reliability, this is more dangerous because users may run it as root on fresh infrastructure, making host compromise or unintended configuration changes high impact.- Content
md # Download template: Datacenter → Storage → CT Templates → Download → debian-12 # Create CT: 2 cores, 2GB RAM, 32GB disk, bridge vmbr0 # Inside CT: install Docker apt install -y curl curl -fsSL https://get.docker.com | sh # 3. Enable IOMMU for GPU passthrough (if needed)
Static analysis
No suspicious patterns detected.