Security audit

Caprover Management

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent CapRover admin helper, but it handles privileged infrastructure credentials in unsafe ways that warrant review before installation.

Review carefully before installing. Use only after changing the helper and examples to verify TLS certificates, preferably by trusting the CapRover server's CA certificate. Do not pass the admin password on the command line or print token material, and require explicit user confirmation before deployments, service overrides, app deletion, or volume deletion.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/caprover.py:27
Finding: Disabled TLS Verification Exposes CapRover Administrator Credentials and Privileged API Traffic
Content: View full analysis
str: r = self._call("/api/v2/login", {"password": password}) return r["data"]["token"] ``` It is also used for all subsequent privileged requests carrying the `x-captain-auth` token: ```python tok = token or getattr(self, "token", None) if tok: headers["x-captain-auth"] = tok ``` Consequently, the exposed data may include: - The CapRover administrator password. - The session bearer token. - Application environment variables, which may cont ...[truncated 2431 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/caprover.py:247
Finding: CapRover Administrator Password Is Accepted Through Process Arguments and Session Token Material Is Logged
Content: View full analysis
[app_name]") sys.exit(1) cap = CapRover(sys.argv[1], sys.argv[2]) print(f"Authenticated. Token: {cap.token[:20]}...") ``` ### Technical Analysis The command-line interface requires the CapRover administrator password as a positional argument. Command-line arguments can be exposed through: - Shell command history. - Process inspection facilities such as `/proc`, subject to operating-system access controls. - Process-monitoring and endpoint-management software. - CI/CD job definitions and execution logs. - Terminal recording or debugging output. - Wrapper scripts that preserve the invoked command. The script also prints the first 20 characters of the authentication token. A partial token normally does not provide enough information to authenticate by itself, but disclosing bearer-token material is unnecessary. If the token is a JWT, the printed prefix may expose part or all of its encoded header and payload metadata. It also creates avoidable sensitive output in terminals and logs. The Skill only needs to receive the password securely and retain the returned token in memory for authenticated requests. Neither passing the password through process arguments nor printing token material is required for its declared functionality. ### Attack Path 1. An administrator runs: ```bash python3 scripts/caprover.py https://captain.example.com administrator-password myapp ``` 2. The complete password becomes part of the shell command and process argument vector. 3. A local user, monitoring agent, CI log reader, shell-history reader, or other party with relevant access retrieves the command. 4. The attacker extracts the administrator password. 5. The attacker authenticates di ...[truncated 1145 chars]
Remediation: View remediation
[app_name]") sys.exit(1) password = getpass.getpass("CapRover administrator password: ") cap = CapRover(sys.argv[1], password) print("Authenticated successfully.") ``` 2. Remove all token output, including partial token values. Log only authentication success or failure. 3. For automation, support a protected secret source such as: - A file readable only by the executing account. - A CI/CD secret-injection mechanism. - A platform credential manager or secrets vault. - Standard input through a documented non-echoing workflow. 4. If an environment-variable fallback is provided, document that environment variables may also be visible to child processes, diagnostic tools, crash dumps, or improperly configured CI systems. Prefer file descriptors or a dedicated secret manager where possible. 5. Avoid placing passwords or tokens in exception messages, debug logs, serialized objects, or application output. 6. Rotate passwords and invalidate tokens if credentials have already appeared in shell history, process-monitoring records, terminal captures, or CI logs. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly instructs clients to disable TLS certificate verification for API connections. That defeats server authentication and enables man-in-the-middle interception or modification of authenticated CapRover API traffic, including JWT tokens, app configs, registry credentials, and deployment payloads. In this skill context, the API performs privileged deployment and infrastructure actions, which makes insecure transport guidance especially dangerous.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The SSL context explicitly disables certificate validation and hostname checking for all HTTPS requests, including login and authenticated API calls. This makes the helper vulnerable to man-in-the-middle interception, allowing an attacker on the network path to capture the CapRover admin password and session token or tamper with deployment actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill includes concrete network-capable code that authenticates to and manages a remote CapRover instance, but it does not declare any tool scope or permission boundary. That omission increases the chance an agent could use network access without clear user visibility or policy enforcement, enabling unintended remote administrative actions against infrastructure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs users to authenticate with a CapRover password and bearer-like auth token, but provides no guidance on secret handling, storage, redaction, or avoidance of logging. In this context the credentials grant administrative control over apps, deployments, env vars, volumes, and logs, so accidental disclosure could lead to full compromise of the CapRover-managed environment.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The phrase 'disable verification in HTTP clients' encourages the agent or consuming code to make an unsafe security decision automatically rather than preserving certificate validation. When applied to a management API that controls apps, volumes, env vars, logs, and registry credentials, this can expose administrative sessions and allow an attacker on-path to tamper with deployments or steal secrets.
Content: Scanner excerpt · references/api.md (reported line 6)May include surrounding context.
md
Base URL: `https://<captain-domain>` Auth header: `x-captain-auth: <token>` All bodies: `Content-Type: application/json` SSL: often self-signed → disable verification in HTTP clients ## Table of Contents 1. [Authentication](#authentication)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI path prints a live authentication token prefix after login, which exposes sensitive credential material to terminals, shell history capture, logs, screenshots, or CI job output. Even partial token disclosure increases the attack surface and is unnecessary for normal operation, especially in a deployment/admin helper that handles privileged CapRover access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI prints the first portion of the authentication token immediately after successful login, which can leak privileged session material into console logs and other monitoring surfaces. In this skill's context, the token grants administrative control over app deployment and configuration, so even limited exposure is more dangerous than in a low-privilege tool.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.