T03 · Remote Payload Retrieval and Execution
Error
- Location
install/commands.md:17- Finding
Unverified Remote Bootstrap Script Executed with Root Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
dokku
Security checks for vulnerabilities and agentic risk
Overview
This Dokku administration skill is coherent, but it needs Review because it documents root-level installs, broad SSH access grants, secret-revealing config commands, and destructive host-wide operations without enough scoping or safety guidance.
Install only if you want an agent to help administer a Dokku host. Before running commands from this skill, confirm the target host and app, avoid generic activation for non-Dokku deploys, verify downloaded installers and plugin repositories, pin trusted plugin commits where possible, add only specific reviewed public SSH keys, treat config output as secret material, and require explicit confirmation before destroy, prune, force, global-domain, certificate-removal, or bind-all-interfaces actions.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
install/commands.md:28- Finding
All Existing Authorized SSH Keys Are Granted Dokku Access
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
plugin/commands.md:13- Finding
Unpinned Third-Party Plugins Are Installed with Root Privileges
- Content
View full analysis
# Example: sudo dokku plugin:install https://github.com/dokku/dokku-postgres.git ``` ``` From `certs/commands.md`: ```bash For automated SSL, install the optional letsencrypt plugin: ```bash sudo dokku plugin:install https://github.com/dokku/dokku-letsencrypt.git dokku letsencrypt:set --global email your@email.com dokku domains:set .your.domain.com dokku letsencrypt:enable dokku letsencrypt:cron-job --add ``` ``` From `cleanup/commands.md`: ```bash For **aggressive** cleanup (e.g. wipe everything): the community plugin [dokku-nuke](https://github.com/dokku-community/dokku-nuke) stops all running containers and deletes all containers and images. Use only when you intend to remove all apps and images from the host. ```bash sudo dokku plugin:install https://github.com/dokku-community/dokku-nuke.git # Then run per plugin docs (destructive). ``` ``` ### Technical Analysis The Skill recommends installing plugins directly from Git repository URLs using `sudo`. These references do not pin an immutable commit or signed release, and no checksum, signature verification, source review, or trusted-publisher validation is required. The generic `` form is particularly risky if an untrusted party can influence the URL supplied to the agent. A Dokku plugin may contain installation hooks and executable commands. Running its installer with root privileges makes repository integrity part of the host's root trust boundary. The named repositories appear relevant to the declared Dokku administration functionality, and no evidence s ...[truncated 1312 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
config/commands.md:5- Finding
Application Secrets Can Be Exposed Through Configuration Display and Export Commands
- Content
View full analysis
``` ## config:get Display a specific environment variable. ```bash dokku config:get ``` ``` ```bash ## config:export Export config to format (e.g. env, shell). Useful for backups or CI. ```bash dokku config:export dokku config:export --format env ``` ``` ### Technical Analysis Dokku application environment variables commonly contain database passwords, API tokens, signing keys, cloud credentials, session secrets, and other sensitive values. The documented commands print these values in plaintext. The Skill does not warn that output may be sensitive, require explicit confirmation before a complete export, direct the agent to redact returned values, or specify protected storage and file permissions for backups. In an agent environment, command output may be retained in execution logs, transcripts, monitoring systems, or CI logs. These commands are legitimate Dokku administration functions and there is no evidence of automatic external exfiltration. The issue is unsafe handling and presentation of potentially secret-bearing output. ### Attack Path 1. A user or agent runs `dokku config ` or `dokku config:export `. 2. Dokku prints all application configuration values, including secrets. 3. The execution environment captures the output in a transcript, log, CI artifact, terminal recording, or monitoring platform. 4. Another party with access to that retained output retrieves the exposed credentials. 5. The party uses the credentials against databases, APIs, cloud services, or the affected application. ### Impact Assessment The direct command runs with the current Dokku administrator's acc ...[truncated 404 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (44)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Add SSH key
bash cat ~/.ssh/authorized_keys | sudo dokku ssh-keys:add adminSet global domain
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Add SSH key
bash cat ~/.ssh/authorized_keys | sudo dokku ssh-keys:add adminSet global domain
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown advertises capabilities such as deploying apps, cleaning up containers, and destroying apps, all of which can affect availability or permanently remove resources. The description does not include any cautionary note about data loss, downtime, or the need to verify targets before running such commands.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger terms include very broad words like "deploy" and "cleanup," which are common across many unrelated tasks and can cause this skill to activate when the user did not specifically intend Dokku operations. Because this skill includes destructive and privileged actions on a Dokku host, accidental activation increases the risk of unintended deployments, pruning, or app/container modifications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises destructive capabilities such as app destruction, pruning, uninstall, and cleanup workflows without clear warnings, guardrails, or confirmation requirements. In a host-level administration context, users may not appreciate that these commands can permanently delete apps, containers, configuration, or runtime state, making accidental misuse materially more dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents
dokku --force apps:destroy <app>, which permanently destroys an app and all add-ons without confirmation. Although L21 notes permanence and the normal prompt behavior, it does not explicitly warn users about the elevated risk of bypassing confirmation with--forceor advise caution before using it.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file describes
certs:removeas simply removing a certificate for an app, but it does not warn that doing so can disrupt TLS/HTTPS for that app or affect live traffic. For markdown files, safety-impacting actions that can affect system integrity or service availability should include a user-facing warning.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
bash sudo docker system prune sudo docker system prune -f # skip confirmationRemove unused images (including non-dangling)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
Installing a community plugin directly from a Git repository as root introduces a real supply-chain risk, because the plugin code will be fetched and installed with elevated privileges on the host. Even though the text labels it as aggressive and destructive, it does not advise pinning to a trusted commit, verifying publisher integrity, or reviewing plugin code before installation.
- Content
For aggressive cleanup (e.g. wipe everything): the community plugin dokku-nuke stops all running containers and deletes all containers and images. Use only when you intend to remove all apps and images from the host.
bash sudo dokku plugin:install https://github.com/dokku-community/dokku-nuke.git # Then run per plugin docs (destructive).
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The
configandconfig:getcommands display environment variables directly, but the documentation omits any caution that these values may contain credentials or other secrets. Users may run them in shared terminals, record them in shell history, or capture them in support logs and screenshots, leading to accidental exposure.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation advertises
config:exportas useful for backups or CI but does not warn that exported application configuration commonly includes secrets such as API keys, database passwords, and tokens. In practice, users may redirect this output into logs, CI artifacts, shell history, or shared files, causing unintended secret disclosure.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file describes operations that replace or delete existing domain configuration, including
domains:set,domains:clear, anddomains:reset, but it does not warn users that these actions can remove current mappings and affect app routing. For markdown files, omissions of warnings about behaviors that can affect system integrity or service availability should be flagged.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation includes
domains:set-global,domains:remove-global, anddomains:clear-global, which alter or remove global domain configuration for all apps, yet there is no warning about the broad operational impact. In markdown skill descriptions, system-wide changes that can affect user services should include clear user-facing cautions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions download a remote bootstrap script and execute it with sudo, giving network-fetched code full root privileges. Even if this is a common installation pattern, it is risky because compromise of the download source, transport, or referenced version could lead to complete host takeover.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
This command runs the bootstrap installer under sudo, so any action performed by the script executes with elevated privileges. In installation documentation this may be operationally necessary, but it still creates real risk if the script is tampered with or behaves unexpectedly.
- Content
bash wget -NP . https://dokku.com/install/v0.37.5/bootstrap.sh sudo DOKKU_TAG=v0.37.5 bash bootstrap.shInstallation takes about 5–10 minutes. Then configure SSH and domain.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation explicitly recommends or describes binding an app to all interfaces (0.0.0.0) without any warning that this can expose the service beyond localhost or expected internal networks. In an operations skill, users may copy commands directly, so omitting the security caveat increases the chance of accidental public exposure of admin or internal services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file documents commands that install software from a URL and requires sudo, which can modify system state and affect system integrity. While the commands are described functionally, the file does not include an explicit warning about the risks of installing untrusted plugins or making privileged changes.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Download and install a plugin. Usually requires root/sudo.
bash sudo dokku plugin:install <url> # Example: sudo dokku plugin:install https://github.com/dokku/dokku-postgres.git
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Download and install a plugin. Usually requires root/sudo.
bash sudo dokku plugin:install <url> # Example: sudo dokku plugin:install https://github.com/dokku/dokku-postgres.git
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Download and install a plugin. Usually requires root/sudo.
bash sudo dokku plugin:install <url> # Example: sudo dokku plugin:install https://github.com/dokku/dokku-postgres.git
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Download and install a plugin. Usually requires root/sudo.
bash sudo dokku plugin:install <url> # Example: sudo dokku plugin:install https://github.com/dokku/dokku-postgres.git
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Download and install a plugin. Usually requires root/sudo.
bash sudo dokku plugin:install <url> # Example: sudo dokku plugin:install https://github.com/dokku/dokku-postgres.git
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Download and install a plugin. Usually requires root/sudo.
bash sudo dokku plugin:install <url> # Example: sudo dokku plugin:install https://github.com/dokku/dokku-postgres.git
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Download and install a plugin. Usually requires root/sudo.
bash sudo dokku plugin:install <url> # Example: sudo dokku plugin:install https://github.com/dokku/dokku-postgres.git
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Download and install a plugin. Usually requires root/sudo.
bash sudo dokku plugin:install <url> # Example: sudo dokku plugin:install https://github.com/dokku/dokku-postgres.git
Static analysis
No suspicious patterns detected.