Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Portainer control tool, but it can immediately stop, restart, redeploy, and read logs from Docker infrastructure without built-in confirmation or tight scoping.
Review before installing. Use a least-privilege Portainer token, restrict it to intended environments where possible, protect ~/.clawdbot/.env, and require explicit human confirmation before stop, restart, redeploy, or log commands. Treat container logs as sensitive because they can contain secrets or personal data.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
|------|---------|
| **Portainer** | Version 2.x with API access |
| **Tools** | `curl`, `jq` |
| **Auth** | API Access Token |
### Setup
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
1. **Get API Token from Portainer:**
- Log into Portainer web UI
- Click username → My Account
- Scroll to "Access tokens" → Add access token
- Copy the token (you won't see it again!)
2. **Configure credentials:**
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
1. **Get API Token from Portainer:**
- Log into Portainer web UI
- Click username → My Account
- Scroll to "Access tokens" → Add access token
- Copy the token (you won't see it again!)
2. **Configure credentials:**
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
1. **Get API Token from Portainer:**
- Log into Portainer web UI
- Click username → My Account
- Scroll to "Access tokens" → Add access token
- Copy the token (you won't see it again!)
2. **Configure credentials:**
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -e
# Load config from environment or .env
PORTAINER_URL="${PORTAINER_URL:-}"
PORTAINER_API_KEY="${PORTAINER_API_KEY:-}"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -e
# Load config from environment or .env
PORTAINER_URL="${PORTAINER_URL:-}"
PORTAINER_API_KEY="${PORTAINER_API_KEY:-}"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -e
# Load config from environment or .env
PORTAINER_URL="${PORTAINER_URL:-}"
PORTAINER_API_KEY="${PORTAINER_API_KEY:-}"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -e
# Load config from environment or .env
PORTAINER_URL="${PORTAINER_URL:-}"
PORTAINER_API_KEY="${PORTAINER_API_KEY:-}"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -e
# Load config from environment or .env
PORTAINER_URL="${PORTAINER_URL:-}"
PORTAINER_API_KEY="${PORTAINER_API_KEY:-}"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -e
# Load config from environment or .env
PORTAINER_URL="${PORTAINER_URL:-}"
PORTAINER_API_KEY="${PORTAINER_API_KEY:-}"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -e
# Load config from environment or .env
PORTAINER_URL="${PORTAINER_URL:-}"
PORTAINER_API_KEY="${PORTAINER_API_KEY:-}"
The use of 'export $(grep ... | xargs)' to ingest secrets from ~/.clawdbot/.env is unsafe because it performs shell word-splitting and can misparse special characters, whitespace, or malformed lines, potentially corrupting variables or introducing unexpected environment assignments. It also loads sensitive credentials from plaintext storage into the process environment without validation, which is risky in shared or agent-executed contexts.
# Try to load from clawdbot .env if not set
if [[ -z "$PORTAINER_URL" || -z "$PORTAINER_API_KEY" ]]; then
ENV_FILE="$HOME/.clawdbot/.env"
if [[ -f "$ENV_FILE" ]]; then
export $(grep -E "^PORTAINER_" "$ENV_FILE" | xargs)
fi
The redeploy workflow reads stack environment variables via '.Env' and reuses them in a redeploy payload, which means the script handles potentially sensitive secrets embedded in stack configuration. In an agent context, any future logging, error handling, or downstream exposure of STACK_INFO/ENV_VARS could leak secrets, and the script currently pulls more sensitive configuration than minimally necessary.
# Get stack info for env vars and endpoint
STACK_INFO=$(api_get "/stacks/$STACK_ID")
ENDPOINT_ID=$(echo "$STACK_INFO" | jq -r '.EndpointId')
ENV_VARS=$(echo "$STACK_INFO" | jq -c '.Env')
GIT_CRED_ID=$(echo "$STACK_INFO" | jq -r '.GitConfig.Authentication.GitCredentialID // 0')
PAYLOAD=$(jq -n \
The skill advertises shell-driven operational control over Portainer but does not declare any explicit tool scope such as allowed tools or permissions. In an agent environment, missing scope boundaries can let the agent invoke broader shell capabilities than intended, increasing the blast radius for destructive container and deployment actions.
The skill documents restart, stop, and redeploy operations without a clear warning that these actions can interrupt production services, cause downtime, or redeploy unreviewed code from git. In an autonomous or semi-autonomous agent setting, lack of friction or warning materially increases the chance of harmful accidental execution.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Helper function for API calls
api_get() {
curl -s -H "$AUTH_HEADER" "$API$1"
}
api_post() {
The script exposes state-changing operations such as stack redeploy and container start/stop/restart directly from command inputs with no confirmation, dry-run, authorization gating, or explicit user warning. In an agent-skill context, this increases the risk of accidental or prompt-induced disruption to production services because the skill can immediately perform destructive operational actions against Portainer-managed infrastructure.
The logs command retrieves container logs from the remote Portainer API and prints them verbatim, which can expose secrets, tokens, personal data, or internal system details commonly present in application logs. In an agent setting, this can cause unintended disclosure to the requesting user or downstream systems consuming the tool output.
No suspicious patterns detected.