Deploy Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.1.0

Overview

This Docker deployment skill is coherent, but it needs Review because it can make host-level Docker changes and run or manage containers without enough scoping checks.

Install only if you are comfortable giving the agent Docker-admin-level authority on the host. Avoid using it on untrusted uploaded archives, repositories, or Compose files unless you manually inspect them first, and treat install-docker as a privileged system change rather than a normal deployment step.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/deploy-agent.sh:122
• Finding: Untrusted Docker Compose Files Can Request Host-Level Privileges<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deploy-agent.sh`, lines 122–135 **Vulnerability Type**: Automatic execution of untrusted privileged container configuration **Risk Level**: Critical ### Vulnerable Code ```bash local compose_file="" for cf in docker-compose.yml docker-compose.yaml compose.yml compose.yaml; do [ -f "$dir/$cf" ] && compose_file="$dir/$cf" && break done if [ -n "$compose_file" ]; then echo "━━━ Deploy-Agent: Deploy with Docker Compose ━━━━━" info "Compose file: $compose_file" # Stop existing if running docker compose -f "$compose_file" -p "$name" down 2>/dev/null || true docker compose -f "$compose_file" -p "$name" up -d --build 2>&1 | while IFS= read -r line; do echo " $line"; done local status=${PIPESTATUS[0]} ``` ### Technical Analysis The deployment workflow automatically discovers and executes a project-controlled Docker Compose file. It does not inspect the resolved Compose configuration, enforce a security policy, or ask the user to approve requested privileges. A Compose file can request security-sensitive Docker capabilities, including: - `privileged: true` - Host PID, IPC, or network namespaces - Arbitrary Linux capabilities - Host devices - Bind mounts of `/`, `/etc`, user home directories, or other sensitive paths - A bind mount of `/var/run/docker.sock` - Changes to seccomp or AppArmor protections Because the documented workflow explicitly supports uploaded or otherwise externally supplied projects, an attacker-controlled project can place these directives in a Compose file. Docker daemon access is effectively host-administrative in many environments, so merely placing the workload inside a container does not establish an adequate security boundary. ### Attack Path 1. An attacker supplies a project containing `compose.yml` or another supported Compose filename. 2. The Compose file defines a service with a dangerous setting, such as `privileged: true`, a mount of the ho ...[truncated 967 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the configuration before deployment with `docker compose config` and parse the resulting YAML using a proper YAML parser. 2. Reject or require explicit approval for: - `privileged: true` - Host PID, IPC, or network modes - Docker socket mounts - Host device access - `security_opt` settings that disable confinement - Dangerous capabilities such as `SYS_ADMIN` - Bind mounts outside an explicitly approved project data directory 3. Present a security summary of all services, volumes, ports, capabilities, namespaces, and devices before execution. 4. Run untrusted projects in a dedicated virtual machine or isolated rootless Docker environment rather than against the primary host daemon. 5. Apply resource limits, read-only filesystems, `no-new-privileges`, capability dropping, and non-root users where supported. 6. Require a separate explicit option for privileged Compose deployment rather than enabling it through automatic project detection. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/deploy-agent.sh:225
• Finding: Container Management Commands Are Not Restricted to Deploy-Agent Resources<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deploy-agent.sh`, lines 225–244 **Vulnerability Type**: Missing authorization check for container deletion and log access **Risk Level**: High ### Vulnerable Code ```bash cmd_stop() { local target="${1:-}" [ -z "$target" ] && die "Usage: deploy-agent.sh stop <container-name>" require_docker || exit 1 echo "━━━ Deploy-Agent: Stopping Container ━━━━━" docker stop "$target" 2>/dev/null || warn "Container '$target' not running" docker rm "$target" 2>/dev/null || true ok "Container '$target' stopped and removed" } # ── Logs ── cmd_logs() { local target="${1:-}" [ -z "$target" ] && die "Usage: deploy-agent.sh logs <container-name>" require_docker || exit 1 docker logs -f --tail 50 "$target" } ``` ### Technical Analysis The skill identifies its own containers with the `deploy-agent.managed=true` label, but the `stop` and `logs` commands do not verify that the supplied target has this label. The target can be any Docker container name or ID visible to the current Docker daemon. Consequently: - `stop` can stop and permanently remove an unrelated container. - `logs` can expose output from unrelated workloads. - The implementation violates the documented managed-container boundary. Quoting the target prevents shell command injection, but it does not provide authorization. The vulnerability is therefore an object-level access-control failure rather than a shell injection issue. ### Attack Path 1. An attacker or untrusted caller identifies or guesses the name or ID of an unrelated container. 2. The caller invokes `deploy-agent.sh logs <target>` to access its recent and future log output, or invokes `deploy-agent.sh stop <target>`. 3. The script confirms only that Docker is available. 4. It passes the target directly to `docker logs`, `docker stop`, and `docker rm`. 5. The unrelated container's logs are disclosed, or the workload is stopped and deleted. ### Im ...[truncated 485 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Inspect the target before performing any action: ```bash managed="$(docker inspect \ --format '{{ index .Config.Labels "deploy-agent.managed" }}' \ "$target" 2>/dev/null)" || die "Container not found" [ "$managed" = "true" ] || die "Refusing to manage an unowned container" ``` 2. Perform the ownership check immediately before each sensitive Docker operation to reduce time-of-check/time-of-use risk. 3. Optionally verify both the management label and a skill-specific deployment identifier. 4. Use distinct administrative commands for host-wide container operations and require explicit user confirmation for those commands. 5. Do not report successful removal unless `docker stop` and `docker rm` actually succeeded. 6. Document that container IDs and names alone are identifiers, not proof that a resource belongs to the deploy agent. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/deploy-agent.sh:209
• Finding: Status Command Discloses Unrelated Host Container Metadata<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deploy-agent.sh`, lines 209–217 **Vulnerability Type**: Excessive resource enumeration and information disclosure **Risk Level**: Medium ### Vulnerable Code ```bash containers=$(docker ps -a --filter "label=deploy-agent.managed=true" --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}" 2>/dev/null) if [ -z "$containers" ]; then echo " No managed containers." echo "" echo " All running containers:" docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}" 2>/dev/null || true else echo "$containers" ``` ### Technical Analysis The command initially applies the correct `deploy-agent.managed=true` filter. However, when no matching containers are found, it automatically falls back to an unrestricted `docker ps`. This changes the command's scope from deploy-agent-managed resources to all running containers without separate authorization or an explicit host-wide listing request. The resulting output includes container names, image names, status data, and published ports. ### Attack Path 1. The Docker host has no containers labeled `deploy-agent.managed=true`. 2. The host has one or more unrelated running containers. 3. A caller invokes `deploy-agent.sh status`. 4. The filtered query returns no managed containers. 5. The fallback executes unrestricted `docker ps`. 6. Metadata for unrelated workloads is returned to the caller. ### Impact Assessment The output can reveal application and infrastructure names, software images and versions, service topology, operational status, and externally exposed ports. This information can support subsequent targeting or disclose confidential deployment details. The scope is limited to container metadata available from `docker ps`; this code does not directly reveal container environment variables or filesystem contents. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the unrestricted `docker ps` fallback from the managed `status` command. 2. If host-wide enumeration is needed, expose it through a separately named administrative command. 3. Require explicit user authorization before listing resources not created by the deploy agent. 4. Preserve the managed-resource filter even when it produces no results, and return only a message such as `No managed containers`. 5. Consider enforcing an additional deployment-specific label when multiple users or projects share a Docker daemon. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate-dockerfile.sh:7
• Finding: Unvalidated Port Argument Permits Dockerfile Instruction Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate-dockerfile.sh`, lines 7–8 and 33–150 **Vulnerability Type**: Dockerfile instruction injection through unvalidated generated content **Risk Level**: High ### Vulnerable Code ```bash PROJECT_DIR="${1:-.}" DETECT_TYPE="${2:-}" PORT="${3:-}" ``` The value is later inserted directly into generated Dockerfile instructions, including: ```bash cat > "$GENERATED_FILE" <<- DOCKERFILE # ── Deploy-Agent: Node.js ── FROM node:20-alpine WORKDIR /app COPY package*.json ./ RUN npm ci --only=production 2>/dev/null || npm install --production COPY . . ENV NODE_ENV=production ENV PORT=${PORT} EXPOSE ${PORT} HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \\ CMD wget --no-verbose --tries=1 --spider http://localhost:${PORT}/ || exit 1 CMD ["node", "server.js"] DOCKERFILE ``` Equivalent interpolation is used in the Python, Go, and Rust Dockerfile generation branches. ### Technical Analysis `PORT` is accepted without checking that it is a valid decimal TCP port. Because it is expanded into an unquoted heredoc, a value containing newline characters can terminate the current Dockerfile instruction and introduce additional instructions. For example, a direct caller could supply a conceptual value of: ```text 3000 RUN <attacker-controlled build command> ``` The generated Dockerfile would then contain a new `RUN` instruction. If that Dockerfile is subsequently built, the injected command executes inside the image build environment. Shell quoting at script invocation does not make the generated Dockerfile safe because newline characters remain part of the expanded variable. Validation must occur before content generation. ### Attack Path 1. An attacker gains control of the third argument passed directly to `generate-dockerfile.sh`, or another caller forwards an untrusted port value. 2. T ...[truncated 996 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate the port before generating any content: ```bash [[ "$PORT" =~ ^[0-9]{1,5}$ ]] || { echo "[✗] Invalid port" exit 1 } (( PORT >= 1 && PORT <= 65535 )) || { echo "[✗] Port must be between 1 and 65535" exit 1 } ``` 2. Explicitly reject carriage returns, line feeds, spaces, and all non-decimal characters. 3. Apply the same validation in `deploy-agent.sh` before using a caller-supplied deployment port in Docker arguments. 4. Treat auto-detected values as untrusted as well, even if current detection normally emits hardcoded or numeric values. 5. Prefer structured template generation with narrowly typed values instead of unrestricted shell interpolation. 6. Add regression tests using multiline strings, command substitutions, whitespace, negative numbers, zero, and values above 65535. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (35)

Chaining Abuse

High

• Category: Tool Misuse

Content

| 权限 | 范围 | 用途 | 说明 |
|------|------|------|------|
| 执行 | sudo | Docker 安装、用户组管理 | `bootstrap-docker.sh` 安装 Docker |
| 执行 | docker | 容器管理 | 构建、运行、停止容器 |
| 文件系统 | 读取 | 项目目录 | 检测项目类型、读取构建配置 |
| 文件系统 | 写入 | 项目目录 | 生成 Dockerfile |

• Confidence: 82% confidence
• Finding: The skill combines privileged host setup, filesystem writes, network access, Docker builds, and container execution in one workflow, creating a strong chaining surface. An attacker can supply a malicious project or archive that gets detected, written, built, and run, while the skill normalizes elevated host actions, making abuse substantially more dangerous than a simple single-purpose skill.

Credential Access

High

• Category: Privilege Escalation

Content

sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update -qq
sudo apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill tells the agent to extract user-provided zip/tar archives but provides no safeguards for archive traversal, symlink abuse, overwrite risks, or extraction into sensitive locations. Because uploaded archives are untrusted input, this can lead to arbitrary filesystem writes or planting files that later influence builds or execution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The cleanup example force-removes all containers with the managed label using 'docker rm -f' without an explicit destructive-action warning or confirmation step. If labels are broad or misapplied, this can cause accidental service disruption and data loss for running workloads.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

| 权限 | 范围 | 用途 | 说明 |
|------|------|------|------|
| 执行 | sudo | Docker 安装、用户组管理 | `bootstrap-docker.sh` 安装 Docker |
| 执行 | docker | 容器管理 | 构建、运行、停止容器 |
| 文件系统 | 读取 | 项目目录 | 检测项目类型、读取构建配置 |
| 文件系统 | 写入 | 项目目录 | 生成 Dockerfile |

• Confidence: 84% confidence
• Finding: The permissions table explicitly declares sudo execution for Docker installation and user/group management. In the context of an agent skill that may act on user prompts, advertising privileged execution broadens the trust boundary and increases the risk of host compromise if the workflow is misused or chained with untrusted project content.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "[*] Installing Docker Engine..."
sudo apt-get update -qq
sudo apt-get install -y -qq ca-certificates curl

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update -qq
sudo apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Add current user to docker group (avoid sudo)
sudo usermod -aG docker "$(whoami)" 2>/dev/null || true

• Confidence: 96% confidence
• Finding: Adding the current user to the docker group is security-sensitive because membership effectively grants root-equivalent access on the host through the Docker daemon. A user in this group can mount the host filesystem, start privileged containers, and escape normal local privilege boundaries.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The `install-docker` command invokes a bootstrap script that performs major host-level changes, but the wrapper presents it as a normal subcommand without a strong warning, confirmation, or dry-run behavior. In a skill/agent setting, this increases the risk of unexpected privileged system modification on the host machine.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The deploy flow automatically stops and removes any existing container with the same derived name before starting a new one, without prompting the user or requiring a force flag. In an agent/automation context, this can unexpectedly terminate workloads and destroy container state, especially if naming collisions occur or the target directory name is ambiguous.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Static analysis

No suspicious patterns detected.