T09 · Insecure Skill Coding Practices
Error
- Location
scripts/truenas-ws.mjs:46- Finding
TrueNAS API key transmitted without server certificate verification by default
- Content
View full analysis
- Remediation
View remediation
Security audit
Truenas Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-built for homelab administration, but it gives an agent broad, high-impact control with unsafe credential-transport defaults and weak confirmation boundaries.
Install only if you are comfortable giving an agent administrative access to your NAS and related homelab services. Use least-privilege API keys, prefer HTTPS with certificate validation enabled, avoid plaintext Dockge credentials, review every mutating command before it runs, and do not use the bulk stack update or recursive ACL examples without adapting them to your environment.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dockge-list.mjs:30- Finding
Dockge username and password can be transmitted over plaintext WebSocket connections
- Content
View full analysis
{ console.error("Connected to Dockge"); socket.emit("login", { username: DOCKGE_USER, password: DOCKGE_PASS, token: "" }, (r) => { ``` The documented configuration explicitly encourages an unencrypted endpoint: ```bash export DOCKGE_URL=http://10.0.0.5:5001 export DOCKGE_USER=your-username export DOCKGE_PASS=your-password ``` ### Technical Analysis The scripts accept any `DOCKGE_URL` and immediately send the reusable Dockge username and password through a Socket.IO login event. They do not require HTTPS, warn about plaintext transport, or implement certificate-validation controls. When `DOCKGE_URL` uses `http://`, Socket.IO uses an unencrypted WebSocket transport. Anyone capable of observing or altering the network path can recover the login payload. A DNS or routing attacker could also redirect the client to an attacker-controlled Socket.IO server and collect the submitted credentials. ### Attack Path 1. The victim follows the documented example and configures an `http://` Dockge URL. 2. The victim runs either the list or update script. 3. The script establishes an unencrypted WebSocket connection. 4. A local-network observer captures the Socket.IO login frame, or a network attacker redirects the connection to a spoofed Dockge server. 5. The attacker extracts `DOCKGE_USER` and `DOCKGE_PASS`. 6. The attacker authenticates to the real Dockge instance. 7. The attacker manipulates Compose stacks, images, environment settings, or service state according to the compromised account's privileges. ### Impact Assessment ...[truncated 605 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/app-installation.md:74- Finding
Application dataset ACL template grants recursive modify access to everyone
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/downloads.md:37- Finding
Service API keys are embedded in URL query strings
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dockge-update.mjs:35- Finding
Bulk Dockge updates restart all running stacks without confirmation or result validation
- Content
View full analysis
{ setTimeout(() => { socket.emit("agent", "", "updateStack", name, () => {}); console.error(` Update requested: ${name}`); if (i === stacks.length - 1) { setTimeout(() => { console.error("All updateStack commands sent."); console.log(JSON.stringify({ updated: stacks })); socket.disconnect(); process.exit(0); }, 1000); } }, i * 200); }); } ``` When no stack names are supplied, every running non-TrueNAS stack is selected: ```javascript const running = Object.entries(data.stackList) .filter(([name, v]) => v.status === 3 && !name.startsWith("ix-")) .map(([k]) => k) .sort(); console.error(`Found ${running.length} running stacks`); updateStacks(running); ``` ### Technical Analysis Invoking the script without arguments causes it to update every running stack except names beginning with `ix-`. An update pulls images and restarts workloads, making this a disruptive bulk operation. The script does not request interactive confirmation, provide a dry-run mode, or enforce a maximum scope. It also supplies an empty acknowledgment callback and reports every selected stack as updated after merely sending events. Consequently, rejected, failed, or incomplete operations can be represented as successful. ### Attack Path 1. An agent or operator invokes `dockge-update.mjs` without stack arguments, intentionally or by mistake. 2. The script enumerates all running non-`ix-` stacks. 3. It sends an update ...[truncated 947 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (48)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The documentation promotes a generic curl pattern with a user-controlled base URL and disabled TLS verification via
-k. Combined with a bearer API key, this creates a strong risk of credential interception, SSRF-like misuse toward arbitrary internal hosts, and unsafe invocation against attacker-influenced endpoints.- Content
REST API (Legacy)
bash curl -sk "$TRUENAS_URL/api/v2.0/[endpoint]" \ -H "Authorization: Bearer $TRUENAS_API_KEY"
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Updating Dockge stacks will pull images and restart services, which can cause downtime, configuration drift, or deployment of unreviewed upstream changes. Omitting a clear warning and confirmation step is especially dangerous because the operation affects running workloads and potentially Internet-fetched artifacts.
- Content
Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The lockfile pins engine.io-client's nested ws dependency to 8.18.3, which is flagged for uninitialized memory disclosure and memory-exhaustion denial of service. Because this skill manages a NAS and uses real-time network communication, an exploitable WebSocket client bug could expose sensitive data in memory or let a malicious endpoint degrade availability of the automation handling storage and service operations.
- Content
Known Vulnerable Dependency: socket.io-parser==4.2.5 — 2 advisory(ies): CVE-2026-69185 (Socket.IO: Zero-attachment Memory Exhaustion); CVE-2026-33151 (socket.io allows an unbounded number of binary attachments)
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
socket.io-parser 4.2.5 is flagged for memory-exhaustion issues involving zero or unbounded binary attachments. In a TrueNAS management skill that may maintain long-lived API or event connections, a malicious or compromised server, proxy, or peer could trigger excessive memory consumption and disrupt monitoring or administrative workflows.
- Content
Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The top-level ws dependency is locked to 8.19.0 and is also flagged for memory disclosure and memory-exhaustion denial-of-service vulnerabilities. Given this skill's role in managing storage, snapshots, services, and container stacks, loss of availability or leakage from a network-facing component increases operational risk and could interrupt or expose sensitive homelab administration activity.
- Content
Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The finding identifies ws 8.19.0 as having advisories for uninitialized memory disclosure and memory exhaustion DoS. In a TrueNAS management skill that interacts with remote services over sockets/WebSockets, these flaws are more concerning because an attacker may be able to trigger resource exhaustion or extract unintended memory contents from a long-running automation component.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly states that the skill can create, list, and delete ZFS datasets but provides no warning about destructive impact. In the context of a NAS-management skill, deletion operations can cause immediate and irreversible data loss, so presenting them without safety guidance increases the risk of accidental destructive use by users or autonomous agents.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README claims capabilities for media requests, downloads, and broad monitoring that extend beyond the declared TrueNAS/Dockge/bookmark scope. In an agent skill, overstated scope can mislead operators and downstream agents into trusting or invoking integrations that are undocumented in the manifest, increasing the chance of unintended access to additional services or execution paths.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares access to sensitive environment variables but does not define an explicit tool or permission scope. That increases the chance an agent can invoke the skill more broadly than intended and use secrets without clear least-privilege boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation text is broad enough to match generic requests about storage, backups, containers, bookmarks, or homelab services. In an agent environment, overly broad routing increases the odds this skill is selected for requests involving unrelated systems, secrets, or destructive actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill expands from TrueNAS management into a wide set of unrelated homelab services, each with separate endpoints and API keys. This scope creep materially enlarges the attack surface and makes accidental or unauthorized operations against non-TrueNAS systems more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Dataset creation is a state-changing administrative operation, but the guidance does not require explicit user confirmation or present consequences such as namespace changes, ACL implications, or quota/mount effects. In an autonomous agent context, missing confirmation controls can lead to unintended infrastructure changes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Create Dataset
bash curl -sk -X POST "$TRUENAS_URL/api/v2.0/pool/dataset" \ -H "Authorization: Bearer $TRUENAS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"name": "pool/path/new-dataset"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
Snapshot creation changes the state of user storage and may affect retention, replication, and operational workflows. Without an explicit warning or confirmation requirement, an agent may perform storage-management actions the user did not intend.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The reference section operationalizes support for multiple broad homelab categories outside the manifest's core purpose. That mismatch can cause over-activation and lead the agent to handle unrelated services and credentials under a misleading TrueNAS label.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The common-task shortcut for taking a snapshot encourages direct execution of a state-changing operation without any gating. In a skill meant for agent use, shortcuts like this make accidental execution more likely than in ordinary documentation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This guide contains authenticated, state-changing API calls that create datasets, alter ACLs, install applications, and modify existing app configuration, but it does not prominently warn that these actions change the NAS state and can affect availability, permissions, and storage layout. In an agent skill context, such examples can be copied or operationalized automatically, increasing the risk of unintended destructive or security-relevant changes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Main app folder curl -sk -X POST "$TRUENAS_URL/api/v2.0/pool/dataset" \ -H "Authorization: Bearer $TRUENAS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"name": "apps/config/APP_NAME"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This API call changes filesystem ACLs and grants broad rights, including FULL_CONTROL and MODIFY entries affecting owner, group, everyone, and specific groups. In the TrueNAS context, incorrect ACL application can overexpose app data, weaken isolation between services, and create persistent privilege or data access issues across mounted datasets.
- Content
CRITICAL: Use
user: "apps"andgroup: "apps"as STRINGS, not numeric uid/gid.bash curl -sk -X POST "$TRUENAS_URL/api/v2.0/filesystem/setacl" \ -H "Authorization: Bearer $TRUENAS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | jq '.[0] | {name, state, portals, volumes: .active_workloads.volumes}' # Verify ACL curl -sk -X POST "$TRUENAS_URL/api/v2.0/filesystem/getacl" \ -H "Authorization: Bearer $TRUENAS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"path": "/mnt/apps/config/APP_NAME"}' \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This API call updates an existing app's configuration through an authenticated management endpoint. Without strong warnings, validation, and confirmation, an agent or user could apply unsafe settings that alter networking, storage mappings, privileges, or app behavior, causing exposure or service disruption.
- Content
Update Existing App
bash curl -sk -X PUT "$TRUENAS_URL/api/v2.0/app/id/APP_NAME" \ -H "Authorization: Bearer $TRUENAS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"values": {"section": {"option": "value"}}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Verify auth curl -s "$KARAKEEP_URL/api/v1/users/me" \ -H "Authorization: Bearer $KARAKEEP_API_KEY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document instructs the agent to trigger AI summarization and notes that AI tagging runs automatically on new bookmarks, but it does not warn that bookmark content, notes, URLs, and extracted page text may be processed by an AI subsystem. In a bookmark manager, this can expose sensitive user data to additional processing or external model providers without informed user consent, especially when notes or saved links contain private material.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Health check curl -s "$AUDIOBOOKSHELF_URL/healthcheck" # Verify auth curl -s -X POST "$AUDIOBOOKSHELF_URL/api/authorize" \
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This documentation materially expands the skill from TrueNAS administration into controlling external download clients and related services. That broader capability can let an agent manipulate torrent/usenet activity, add new downloads, and interact with systems not clearly covered by the declared scope, increasing the chance of unintended or unauthorized actions.
- Content
Static analysis
No suspicious patterns detected.