Docker Socket Proxy

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:39 PM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it gives an agent powerful Docker control over a plaintext remote proxy without enough safety scoping or warnings.

Install only if you intend to let the agent manage the target Docker host. Use a tightly configured docker-socket-proxy, enable only the needed API sections, avoid exposing it over untrusted networks, and treat exec, kill, stop/restart, and prune as high-impact operations that can reveal secrets, disrupt services, or delete resources.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run-docker.sh:5

Finding

Unencrypted Remote Docker Management Transport

Content

View full analysis

Vulnerability Details

File Location: scripts/run-docker.sh:5-12, 95, 212, 291, 386-389, 582
Vulnerability Type: Plaintext transmission of sensitive Docker API traffic
Risk Level: High

Vulnerable Code

bash

# Resolve proxy URL
if [[ -n "${DOCKER_PROXY_URL:-}" ]]; then
  BASE_URL="${DOCKER_PROXY_URL}"
elif [[ -n "${DOCKER_HOST:-}" ]]; then
  BASE_URL="${DOCKER_HOST/tcp:\/\//http://}"
else
  BASE_URL="http://localhost:2375"
fi
BASE_URL="${BASE_URL%/}"

The resulting URL is used directly for Docker management requests, including general API calls, events, logs, and command execution:

bash

response=$(curl "${args[@]}" "${BASE_URL}${path}" 2>&1)

bash

curl -sf "${BASE_URL}/events?${qs}" | jq -r '
  "\(.time | todate) \(.Type) \(.Action) \(.Actor.Attributes.name // .Actor.ID[:12])"'

bash

curl -sf "${BASE_URL}/containers/${id}/logs?stdout=1&stderr=1&tail=${tail}" | strip_frames

bash

curl -sf -X POST -H 'Content-Type: application/json' \
  -d '{"Detach":false,"Tty":false}' \
  "${BASE_URL}/exec/${exec_id}/start" | strip_frames

bash

curl -sf "${BASE_URL}/services/${name}/logs?stdout=1&stderr=1&tail=${tail}" | strip_frames

Technical Analysis

When DOCKER_HOST uses the conventional tcp:// syntax, the script automatically converts it to http://. The default endpoint is also plaintext HTTP. The implementation does not enforce TLS for non-loopback hosts and does not provide explicit CA-certificate or mutual-TLS configuration.

Consequently, Docker API requests and responses may cross the network without confidentiality or integrity protection. Depending on the proxy permissions, this traffic can contain container environment variables, logs, infrastructure metadata, arbitrary commands submitted through the exec mode, and high-impact lifecycle or pruning requests.

The Docker Socket Proxy limits API endpoints but does not itself make plaintext transport secure. Network-path attackers may still obs ...[truncated 1566 chars]

Remediation

View remediation

Remediation Suggestions

1. Require https:// for every non-loopback Docker proxy endpoint and reject remote http:// URLs by default.
2. Do not automatically convert tcp:// to http://. Require an explicit secure scheme or map remote TCP endpoints to HTTPS only under a documented policy.
3. Add explicit TLS settings for:
   • a trusted CA certificate;
   • a client certificate and private key when mutual TLS is used;
   • strict hostname verification.
4. Never use options that disable certificate verification.
5. If plaintext localhost support is necessary, permit it only for validated loopback addresses and Unix-local forwarding.
6. Place the proxy on an authenticated, isolated management network and restrict inbound access with firewall rules.
7. Keep Docker Socket Proxy endpoint permissions minimal, especially for EXEC, destructive lifecycle operations, and prune endpoints.
8. Update README.md and SKILL.md to warn against exposing port 2375 over untrusted networks and to provide a secure TLS deployment example.
9. Add startup validation that fails closed when a non-loopback endpoint lacks TLS.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents operations such as start, stop, restart, kill, prune, and exec against Docker resources, which can disrupt services or delete resources. Although the README explains why using a proxy is safer than exposing the raw socket, it does not explicitly warn users that running these commands may affect container availability or remove data/resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill exposes multiple destructive Docker operations such as stop, restart, kill, prune, rename, and exec, but the documentation does not prominently warn that these actions can disrupt production services, delete resources, or enable command execution inside containers. In this context, the proxy reduces raw socket exposure but still grants powerful control over a remote Docker host, so absent safety guidance increases the risk of accidental service outage or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The inspect command exposes container mounts, environment variables, labels, ports, and networks, which can include secrets or sensitive infrastructure details. Although the script prints the resulting data, there is no warning in comments, usage text, or an explicit disclosure that this mode may reveal sensitive values.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run-docker.sh (reported line 386)May include surrounding context.

sh

cmd_json=$(printf '%s\n' "$@" | jq -R . | jq -sc .)
    exec_body="{\"AttachStdout\":true,\"AttachStderr\":true,\"Cmd\":${cmd_json}}"
    exec_id=$(docker_post "/containers/${id}/exec" "$exec_body" | jq -r '.Id')
    curl -sf -X POST -H 'Content-Type: application/json' \
      -d '{"Detach":false,"Tty":false}' \
      "${BASE_URL}/exec/${exec_id}/start" | strip_frames
    ;;

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The image-inspect mode returns image configuration including environment variables, labels, commands, and exposed ports. This can reveal embedded credentials or internal configuration, but the script provides no warning in the help text or surrounding documentation that sensitive information may be displayed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.