Security audit

Dokploy API

Security checks across malware telemetry and agentic risk

Overview

This is a broad Dokploy admin API connector with safety notes, but it defaults to a specific third-party Dokploy server and exposes high-impact credential, identity, billing, and infrastructure controls.

Install only if you intend to give an agent broad administrator-level access to a Dokploy instance. Before using it, confirm the API base URL is changed to your own Dokploy server, use a narrowly scoped/revocable API key where possible, and require explicit confirmation for user, SSO, billing, SSH key, server, schedule, delete, restart, and credential-changing actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (40)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest frames the skill as narrowly scoped to Dokploy-specific operations, but the declared module set includes broad administrative and third-party integration surfaces such as admin, settings, security, user, SSO, billing, and multiple VCS providers. This mismatch can cause over-broad activation, unsafe delegation, or unexpected privileged actions because consumers may trust the description more than the actual capability footprint.

Context-Inappropriate Capability

High

Confidence: 89% confidence
Finding: The `schedule.runManually` endpoint enables immediate execution of previously configured scheduled commands, which is an operationally powerful action with direct command-execution consequences. In an agent skill context, exposing this capability without strong guardrails or explicit confirmation increases the risk of unsafe execution, privilege misuse, or accidental triggering of destructive maintenance jobs.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This module exposes host-level administrative actions such as reading and writing Traefik files, reloading core services, updating server settings, and storing SSH private keys. In an agent skill context, documenting and enabling these operations without strong guardrails expands the agent's authority beyond ordinary app management into full infrastructure control, which can be abused for service disruption, persistence, or secret access.

Context-Inappropriate Capability

High

Confidence: 84% confidence
Finding: The module exposes private-key creation/import and key generation operations, which are highly sensitive capabilities. In an agent context, these endpoints could enable silent creation, storage, or rotation of credentials that grant infrastructure or source-control access, especially since the documentation provides no approval, scoping, or handling constraints.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The module documents broad user and account-administration operations such as user enumeration, deletion, profile updates, invitation handling, token lookup, and permission management, which exceed the skill metadata’s declared focus on Dokploy apps, deployments, databases, domains, backups, and settings. This scope expansion increases the chance that an agent can be induced to perform sensitive identity or tenant-administration actions that users did not intend when invoking a Dokploy infrastructure skill.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This module exposes highly privileged capabilities including permission assignment, root-access checks, API key creation/deletion, and token generation/retrieval. In an agent context, such endpoints are especially dangerous because they enable privilege escalation, credential lifecycle manipulation, and security-boundary discovery using only the configured API key, even though those capabilities are not justified by the stated skill purpose.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest says the skill should be used for Dokploy app/deployment/database/domain/backup/settings work, but the OpenAPI spec also exposes broad administrative surfaces such as user management, org administration, SSO, billing, licensing, SSH keys, servers, clusters, and registries. This creates dangerous capability overreach: an agent or caller selecting the skill based on its manifest could unintentionally gain access to powerful account- and infrastructure-level operations far outside the advertised scope.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Billing and licensing endpoints are unrelated to the stated operational scope and enable actions like subscription management, license activation/deactivation, and enterprise feature changes. In an agent setting, exposing these functions under a broadly described Dokploy operations skill increases the risk of unauthorized commercial/account changes through prompt confusion or tool misuse.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The spec includes identity and access administration features such as user management, permissions assignment, API key creation/deletion, token generation, and user lookup by token, none of which are justified by the manifest scope. This is especially dangerous because these endpoints can expand access, create persistent credentials, or disclose identity data, turning a deployment-oriented skill into a privilege-management surface.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: SSO and organization administration are highly sensitive control-plane functions that can alter authentication behavior, trusted origins, membership roles, default org selection, and invitations. Because the manifest frames the skill as Dokploy app/deployment/database/domain/backup/settings work, these hidden administrative capabilities materially increase the chance of overprivileged use and security boundary changes without appropriate operator awareness.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill exposes creation, update, testing, and deletion of notification integrations across Slack, Telegram, Discord, email, Resend, Gotify, ntfy, Teams, Pushover, custom webhooks, and more. These endpoints handle secrets and outbound delivery channels, so exposing them outside the advertised scope increases the risk of credential misuse, exfiltration paths, or attacker-controlled alert routing.

Vague Triggers

Low

Confidence: 82% confidence
Finding: The manifest description is generic and does not define concrete activation constraints, exclusions, or user-intent requirements, even though the skill exposes authenticated mutation capabilities against infrastructure APIs. Without clear trigger scope, an orchestrator or agent may invoke the skill in ambiguous situations, increasing the chance of unintended privileged operations.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The module documents passing a third-party `apiKey` as a query parameter to `ai.getModels`, which is prone to leakage through logs, browser history, intermediaries, and monitoring systems. In a skill context, this is more dangerous because agents may automatically assemble and send requests, increasing the chance that secrets are exposed or retained in tooling telemetry.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The module documents create operations that accept sensitive fields such as app passwords and API tokens without warning users that these secrets will be transmitted to the Dokploy service and potentially stored there. In an agent setting, missing sensitivity warnings increases the chance of users or downstream automation supplying credentials without informed consent or proper handling.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The connection-testing endpoint encourages submission of Bitbucket credentials for live validation but does not warn that this may trigger external network access and secret handling by the service. That omission is dangerous because users may treat a test action as harmless validation when it actually transmits reusable credentials to a backend and onward to Bitbucket.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The update endpoint allows modifying stored Bitbucket credentials and connection settings without warning that existing integration state may be changed and secrets rotated or replaced. In an automated agent context, this can lead to unintended credential overwrite, service disruption, or silent reconfiguration of repository access.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The `cluster.removeWorker` endpoint performs a destructive infrastructure action, yet the documentation provides no warning about operational impact, validation expectations, or confirmation requirements. In an agent skill, this increases the chance of accidental or ill-considered execution that could remove a production worker and disrupt service availability.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The invocation example demonstrates direct use of an API key without any handling guidance, which can normalize insecure practices such as pasting secrets into logs, chat, screenshots, or shell history. In agent-integrated environments, this increases the risk of credential exposure and subsequent unauthorized API use.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The module documents destructive operations like killing a deployment process and removing a deployment, but gives no warning about operational impact, irreversibility, or the need for confirmation. In an agent skill context, that omission increases the chance that an automated workflow or user invokes these endpoints without understanding they can interrupt service or permanently remove deployment state.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The invocation template shows direct use of an x-api-key but does not include guidance on protecting the credential from logs, shell history, screenshots, or accidental commits. While not an exploit by itself, this can normalize unsafe handling of secrets and increase the risk of credential exposure in real use.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation exposes endpoints that handle highly sensitive credentials (`accessKey`, `secretAccessKey`) and includes a destructive removal operation without any safety guidance, masking requirements, confirmation expectations, or warnings about accidental deletion and secret handling. In an agent skill context, this increases the chance that an automated agent will transmit secrets verbatim or perform irreversible actions without adequate user confirmation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The module exposes a state-changing `docker.restartContainer` endpoint without documenting disruption risk, preconditions, or confirmation requirements. In an agent context, that omission can lead to unsafe automated execution that restarts production containers and causes avoidable downtime or incident escalation.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The module documents endpoints that accept sensitive fields such as `secret`, `authId`, API-key-authenticated provider configuration, and connection testing, but it gives no warning about credential sensitivity, storage expectations, or the side effects of testing external connections. In an agent skill context, this increases the risk of accidental secret exposure, unsafe logging, or user-unaware mutations against external GitLab infrastructure.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The module documents a destructive `gitProvider.remove` operation without any warning, confirmation guidance, or guardrails around deletion impact. In an agent skill context, that increases the risk of accidental or insufficiently reviewed destructive actions against configured Git integrations, especially because the endpoint is authenticated and operationally real.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The module exposes destructive operations such as remove, rebuild, move, stop, and status-changing actions without any inline warning, confirmation guidance, or indication of operational/data-loss risk. In an agent skill context, this increases the chance that an automated workflow invokes high-impact actions without adequate human review, causing service disruption or irreversible loss.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.