ClawHub
Back to skill

Security audit

docker-remote

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent SSH-based Docker administration helper, but it merits review because it can run commands and change remote services without strong built-in scoping or safety warnings.

Install only if you intend the agent to administer trusted remote Docker hosts over SSH. Use a dedicated least-privilege deployment user, avoid root where possible, review any deploy-apps.json aliases and update commands, and require human confirmation before stop/down/update/exec operations on production services.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Credential Access

High
Category
Privilege Escalation
Content
To use a specific key:

```
docker_compose_up host=192.168.1.100 user=admin path=/opt/app key_path=/home/admin/.ssh/deploy_key
```

### SSH Agent Forwarding
Confidence
90% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Security Best Practices

1. **Never expose sensitive configurations** - Protect .env files, credentials, and secrets:
   - Never log, display, or output `.env` files or any configuration containing secrets
   - When exec'ing into containers, avoid printing sensitive environment variables
2. **Use dedicated deployment users** instead of root
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
ssh user@host "sudo systemctl status sshd"

# Verify key permissions
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
```
Confidence
90% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
ssh user@host "sudo systemctl status sshd"

# Verify key permissions
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
```
Confidence
90% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Docker Socket Access

High
Category
Privilege Escalation
Content
ssh user@host "groups"

# Verify Docker socket permissions
ssh user@host "ls -la /var/run/docker.sock"
```
Confidence
90% confidence
Finding
Potential security issue detected. Manual review is recommended.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documents `docker_compose_down` as stopping and removing containers, networks, and volumes on a remote host, but it does not include any explicit warning that this can cause service outage and potential data loss. In a remote-management skill, destructive actions are expected, but omitting impact warnings increases the chance of accidental misuse, especially when examples use privileged accounts and production-like paths.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The `docker_compose_update` action allows a custom `command` to be executed remotely, e.g. `sh ./upgrade.sh`, which is effectively arbitrary remote command execution. Because the documentation presents this capability without a strong warning, restriction, or validation guidance, a user or downstream agent could execute unsafe commands on the remote server, leading to host compromise or destructive changes.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The `docker_compose_exec` action exposes arbitrary command execution inside a running container on a remote server, again without warning about operational impact, secret exposure, or the possibility of container escape through misconfiguration. In this skill context, remote container exec is a legitimate admin function, but it is inherently dangerous because it can alter application state, read sensitive data, and potentially pivot if the container is privileged or mounted to sensitive host resources.

Vague Triggers

Medium
Confidence
84% confidence
Finding
This JSON manifest contains example commands and descriptions, but it does not define any explicit activation boundaries, negative examples, or scope constraints for when these remote Docker operations should be invoked. Because manifest files are in scope for vague-trigger review, the absence of specificity around invocation context could allow overly broad matching to common intents like starting, restarting, or checking services.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Add user to docker group
ssh user@host "sudo usermod -aG docker $USER"

# Or use root user for docker commands
docker_compose_up host=192.168.1.100 user=root path=/opt/app
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Add user to docker group
ssh user@host "sudo usermod -aG docker $USER"

# Or use root user for docker commands
docker_compose_up host=192.168.1.100 user=root path=/opt/app
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
ssh -p 22 user@host "pwd"

# Check SSH daemon status
ssh user@host "sudo systemctl status sshd"

# Verify key permissions
chmod 600 ~/.ssh/id_rsa
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
ssh -p 22 user@host "pwd"

# Check SSH daemon status
ssh user@host "sudo systemctl status sshd"

# Verify key permissions
chmod 600 ~/.ssh/id_rsa
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
ssh user@host "sudo systemctl status sshd"

# Verify key permissions
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
```
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Verify key permissions
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
```

### Docker Issues
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Low
Confidence
58% confidence
Finding
The natural-language descriptions and command strings assume a fixed environment using host 192.168.1.100 and user admin, but they do not explain whether the skill is restricted to a specific environment or region. While not a strong violation, this kind of implicit environment constraint can create policy ambiguity if the skill is distributed beyond its intended context.

Static analysis

No suspicious patterns detected.