Self-Hosting Mastery

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:26 AM UTC
• Version: 1.0.0

Overview

This self-hosting guide is mostly coherent, but it includes high-impact infrastructure commands that deserve review before an agent follows them.

Install only if you want an agent to provide self-hosting and homelab administration guidance. Before running any generated commands, review them manually, avoid curl-to-shell installers, prefer HTTPS and signed repositories, preview package upgrades, pin container images, and be especially careful with Watchtower or any container that receives Docker socket access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:95
• Finding: Unverified Remote Docker Installation Script Executed Directly by a Privileged Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 95-96 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash apt install -y curl curl -fsSL https://get.docker.com | sh ``` ### Technical Analysis The installation instructions download a mutable shell script from `https://get.docker.com` and immediately pipe its contents into `sh`. Because Docker installation normally requires administrative access, users are likely to run this command as `root` or through an already privileged shell. HTTPS provides transport authentication and encryption, but the command does not pin the expected script version or checksum. It also gives the user no opportunity to inspect the downloaded content before execution. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. Exploitation would require the official endpoint or its upstream delivery infrastructure to be compromised, DNS or trust infrastructure to be subverted, or the remote script to be changed in an unsafe manner. Any commands inserted into the retrieved script would run with the privileges of the invoking shell. ### Attack Path 1. A user or agent follows the Proxmox Docker setup instructions. 2. The command retrieves the current script hosted at `get.docker.com`. 3. The remote response is passed directly to `sh` without local inspection, checksum verification, or version pinning. 4. If the response contains malicious or compromised commands, those commands execute immediately. 5. When run as `root`, the payload can modify system files, install services, access local application data and secrets, or deploy additional persistent components. ### Impact Assessment Successful exploitation can provide arbitrary command execution with the privileges used for installation. In the expected administrative context, this may amount to full host compromise, including: - Reading or modifying system and applicati ...[truncated 497 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace the `curl | sh` installation method with a documented package-repository installation process: 1. Configure Docker's official repository over HTTPS. 2. Download the official signing key over HTTPS and verify its documented fingerprint. 3. Store the key in a dedicated keyring and scope repository trust with `signed-by`. 4. Install explicitly selected and, where operationally feasible, version-pinned Docker packages. 5. Record the selected versions so deployments can be reproduced and audited. If use of the convenience script is unavoidable: 1. Download it to a local file rather than piping it into a shell. 2. Pin the exact script release or expected cryptographic digest. 3. Verify the digest before execution. 4. Review the script and preserve a copy for audit purposes. 5. Execute it only after explicit user approval and with the minimum privileges required. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:87
• Finding: System Package Repository Configured over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 87-89 **Vulnerability Type**: Insecure dependency and package-repository configuration **Risk Level**: Medium ```bash sed -i 's/^deb/#deb/' /etc/apt/sources.list.d/pve-enterprise.list echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" > /etc/apt/sources.list.d/pve-no-subscription.list apt update && apt upgrade -y ``` ### Technical Analysis The instructions disable the existing Proxmox enterprise repository, create a system-wide replacement repository using plaintext HTTP, and immediately perform an unpinned full package upgrade. APT package and repository signatures materially limit an on-path attacker's ability to substitute arbitrary packages: an attacker without a trusted repository signing key should not be able to produce valid malicious package metadata. Nevertheless, HTTP does not provide transport confidentiality or endpoint authentication. An on-path attacker may observe requests, block or replay traffic within the constraints of APT's metadata validation, cause denial of service, or attempt downgrade and stale-metadata scenarios where repository and client protections permit them. The broad `apt upgrade -y` operation also accepts all currently offered upgrades without an explicit version plan or interactive review, reducing reproducibility and increasing exposure to upstream supply-chain or compatibility failures. ### Attack Path 1. A user or agent executes the setup commands with administrative privileges. 2. The commands modify files under `/etc/apt/sources.list.d/`, affecting future system package operations. 3. APT contacts the configured Proxmox repository over plaintext HTTP. 4. An attacker positioned on the network path can inspect, block, redirect, or replay repository traffic. 5. Valid signature checks should reject unsigned modifications, but the attacker may still disrupt updates or attempt stale or downgrade delivery subject to APT's ...[truncated 1218 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the repository URL with the official HTTPS endpoint: ```bash deb https://download.proxmox.com/debian/pve bookworm pve-no-subscription ``` 2. Follow the current official Proxmox repository documentation rather than constructing repository configuration from an unverified example. 3. Install and verify the official repository signing key, including its published fingerprint. 4. Scope the signing key to this repository using a dedicated keyring and the `signed-by` repository option. 5. Configure APT to reject expired metadata and insecure repositories. 6. Separate repository configuration from package upgrades so the user can inspect `apt update` results first. 7. Avoid an unconditional `apt upgrade -y`; preview planned changes and use an explicit maintenance window. 8. Pin critical package versions where reproducibility is required and document rollback procedures before upgrading. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (18)

Chaining Abuse

High

• Category: Tool Misuse

Content

# Create CT: 2 cores, 2GB RAM, 32GB disk, bridge vmbr0
# Inside CT: install Docker
apt install -y curl
curl -fsSL https://get.docker.com | sh

# 3. Enable IOMMU for GPU passthrough (if needed)
# Edit /etc/default/grub: GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on"

• Confidence: 99% confidence
• Finding: `curl ... | sh` is particularly dangerous because it combines network retrieval and immediate shell execution, eliminating any review or verification step. If the remote endpoint, transport, DNS, or upstream supply chain is compromised, arbitrary commands run with the privileges of the user executing the command, which in this setup is likely root inside a container or host environment.

Credential Access

High

• Category: Privilege Escalation

Content

/opt/stacks/           # or ~/docker/
├── traefik/
│   ├── docker-compose.yml
│   ├── .env
│   ├── config/
│   │   └── traefik.yml
│   └── data/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/opt/stacks/           # or ~/docker/
├── traefik/
│   ├── docker-compose.yml
│   ├── .env
│   ├── config/
│   │   └── traefik.yml
│   └── data/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/opt/stacks/           # or ~/docker/
├── traefik/
│   ├── docker-compose.yml
│   ├── .env
│   ├── config/
│   │   └── traefik.yml
│   └── data/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/opt/stacks/           # or ~/docker/
├── traefik/
│   ├── docker-compose.yml
│   ├── .env
│   ├── config/
│   │   └── traefik.yml
│   └── data/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/opt/stacks/           # or ~/docker/
├── traefik/
│   ├── docker-compose.yml
│   ├── .env
│   ├── config/
│   │   └── traefik.yml
│   └── data/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/opt/stacks/           # or ~/docker/
├── traefik/
│   ├── docker-compose.yml
│   ├── .env
│   ├── config/
│   │   └── traefik.yml
│   └── data/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Docker Socket Access

High

• Category: Privilege Escalation

Content

container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_SCHEDULE=0 0 4 * * MON  # Monday 4 AM
      - WATCHTOWER_CLEANUP=true

• Confidence: 96% confidence
• Finding: Mounting `/var/run/docker.sock` into a container gives that container effective control over the Docker daemon, which typically equates to root-level control of the host. In this skill, the socket is given to Watchtower for convenience, but if that container or its supply chain is compromised an attacker can start privileged containers, mount the host filesystem, or execute arbitrary code on the server.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest description defines an expansive scope covering many common infrastructure and backup activities, making accidental invocation more likely. In an agent ecosystem, ambiguous activation can route sensitive system-administration conversations into a skill that contains privileged commands and deployment steps the user may not have intended to invoke.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

│   ├── config/
│   │   └── traefik.yml
│   └── data/
│       ├── acme.json          # chmod 600
│       └── dynamic/
├── monitoring/
│   ├── docker-compose.yml

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

External Transmission

Medium

• Category: Data Exfiltration

Content

log "Backup complete. Total size: $BACKUP_SIZE"

# 8. Send notification (optional)
# curl -s "https://ntfy.sh/my-backups" -d "Backup complete: $BACKUP_SIZE"
```

### Backup Schedule

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 2. Install fail2ban
apt install fail2ban -y
systemctl enable fail2ban

# 3. Automatic security updates
apt install unattended-upgrades -y

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

dpkg-reconfigure -plow unattended-upgrades

# 4. Disable unused services
systemctl list-unit-files --state=enabled
# Disable anything you don't need
```

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

├── Is the port exposed? (`docker port <name>`) → No → Check compose ports/networks
├── Is Traefik routing? (Check Traefik dashboard) → No → Check labels, network
├── Is DNS resolving? (`dig app.example.com`) → No → Check DNS provider
└── SSL error? → Check acme.json permissions (chmod 600), cert resolver logs
```

### Docker Debug Commands

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: These configuration examples impose a specific language and locale in natural-language-facing settings, which can conflict with organizational language/locale choice policies when presented as defaults in a skill. The file does not indicate that these are merely placeholders to be replaced based on user preference or region.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are very broad and overlap with common administrator requests, so the skill may activate in many contexts where the user did not explicitly ask for this skill. Over-broad activation increases the chance of unrequested operational guidance being injected into unrelated workflows, which is a prompt-scope security and safety issue for agent systems.

External Script Fetching

Low

• Category: Supply Chain

Content

# Download template: Datacenter → Storage → CT Templates → Download → debian-12
# Create CT: 2 cores, 2GB RAM, 32GB disk, bridge vmbr0
# Inside CT: install Docker
apt install -y curl
curl -fsSL https://get.docker.com | sh

# 3. Enable IOMMU for GPU passthrough (if needed)

• Confidence: 97% confidence
• Finding: Fetching and executing a remote installation script from `get.docker.com` creates a supply-chain risk because the script is not reviewed, pinned, or integrity-verified before execution. In a self-hosting skill aimed at production-grade reliability, this is more dangerous because users may run it as root on fresh infrastructure, making host compromise or unintended configuration changes high impact.

Static analysis

No suspicious patterns detected.