Security audit

SetupOrion ByImpa

Security checks for vulnerabilities and agentic risk

Overview

This is a real VPS setup skill, but it directs broad privileged server changes with insecure bootstrap, TLS, dependency, and secret-handling practices that need review before use.

Install only after reviewing every command and only on a dedicated VPS you are prepared to rebuild. Replace `curl | bash` with a verified package-repository install, pin container images by version or digest, remove `curl -k` and `--tlsskipverify`, avoid printing tokens or passwords, use Docker secrets or another secret manager, and restrict Portainer to a trusted administrative network. Rotate any credentials if these commands were already run in a logged or untrusted environment.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:66
Finding: Privileged execution of an unverified remote installation script
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:351
Finding: Administrative credentials and bearer tokens transmitted without TLS certificate validation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:272
Finding: Mutable container images are deployed into Docker-management trust boundaries
Content: View full analysis
Remediation: View remediation
`. 2. Maintain an allowlist of approved image digests and require review before updates. 3. Scan images for known vulnerabilities and unexpected components before production deployment. 4. Verify image provenance and signatures where publisher support is available. 5. Avoid automatic production updates through mutable tags. 6. Place dependency updates behind a staged test and approval process. 7. Minimize Docker socket exposure. Where feasible, use a restricted Docker socket proxy that allows only required API operations. 8. Restrict access to `/var/lib/docker/volumes` and avoid writable host-management mounts unless strictly necessary. 9. Apply container hardening such as read-only filesystems, dropped capabilities, non-root users, resource limits, and network segmentation where compatible. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:365
Finding: Administrative tokens, database passwords, and API keys are exposed in output and persistent configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (56)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
bash
# Atualizar sistema sudo apt-get update && sudo apt-get upgrade -y # Instalar utilitários essenciais sudo apt-get install -y apt-utils apparmor-utils curl jq htpasswd ca-certificates gnupg lsb-release

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping remote content directly into bash combines external fetch and immediate execution with no review barrier, making any compromise or change in the fetched content instantly exploitable as root. In this skill, the context is especially dangerous because it is part of production server bootstrap and will often be run unattended or with high trust.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
bash
# Instalar Docker via script oficial curl -fsSL https://get.docker.com | bash # Habilitar e iniciar Docker sudo systemctl enable docker

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
Se falhar, instalar manualmente:

bash
sudo install -m 0755 -d /etc/apt/keyrings OS_ID=$(source /etc/os-release && echo "$ID") OS_CODENAME=$(source /etc/os-release && echo "$VERSION_CODENAME")

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
Se falhar, instalar manualmente:

bash
sudo install -m 0755 -d /etc/apt/keyrings OS_ID=$(source /etc/os-release && echo "$ID") OS_CODENAME=$(source /etc/os-release && echo "$VERSION_CODENAME")

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
Se falhar, instalar manualmente:

bash
sudo install -m 0755 -d /etc/apt/keyrings OS_ID=$(source /etc/os-release && echo "$ID") OS_CODENAME=$(source /etc/os-release && echo "$VERSION_CODENAME")

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
Se falhar, instalar manualmente:

bash
sudo install -m 0755 -d /etc/apt/keyrings OS_ID=$(source /etc/os-release && echo "$ID") OS_CODENAME=$(source /etc/os-release && echo "$VERSION_CODENAME")

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
OS_ID=$(source /etc/os-release && echo "$ID") OS_CODENAME=$(source /etc/os-release && echo "$VERSION_CODENAME") curl -fsSL https://download.docker.com/linux/$OS_ID/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg sudo chmod a+r /etc/apt/keyrings/docker.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/$OS_ID $OS_CODENAME stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
OS_ID=$(source /etc/os-release && echo "$ID") OS_CODENAME=$(source /etc/os-release && echo "$VERSION_CODENAME") curl -fsSL https://download.docker.com/linux/$OS_ID/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg sudo chmod a+r /etc/apt/keyrings/docker.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/$OS_ID $OS_CODENAME stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Docker Socket Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: Traefik is configured to use the Docker socket for dynamic discovery, and Docker socket access effectively grants root-equivalent control over the host via the Docker API. Even though the bind mount is read-only later, exposure of the socket to a network-facing reverse proxy materially increases impact if Traefik or its dependencies are compromised.
Content: Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.
md
command: - "--api.dashboard=true" - "--providers.swarm=true" - "--providers.docker.endpoint=unix:///var/run/docker.sock" - "--providers.docker.exposedbydefault=false" - "--providers.docker.network=NETWORK_PLACEHOLDER" - "--entrypoints.web.address=:80"

Docker Socket Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: Mounting /var/run/docker.sock into a container exposes the host Docker API inside that container. In this context the container is internet-facing infrastructure, so any compromise of Traefik could be chained into host-level container management and effective system takeover.
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
md
volumes: - "vol_certificates:/etc/traefik/letsencrypt" - "/var/run/docker.sock:/var/run/docker.sock:ro" networks: - network_overlay

Docker Socket Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Portainer Agent mounts both the Docker socket and Docker volumes directory, which gives a container extensive control over the Docker host and access to container data. Because Portainer is an administrative plane for the cluster, compromise of the agent or misuse of exposed APIs can lead directly to full cluster and host compromise.
Content: Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.
md
agent: image: portainer/agent:latest volumes: - /var/run/docker.sock:/var/run/docker.sock - /var/lib/docker/volumes:/var/lib/docker/volumes networks: - network_overlay

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Using curl -k disables TLS certificate verification while sending admin bootstrap credentials. That makes the command vulnerable to man-in-the-middle attacks and endpoint spoofing during the most sensitive part of the management plane setup.
Content: Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.
md
# Criar usuário admin (tentativa com retry) for i in 1 2 3 4; do RESPONSE=$(curl -k -s -X POST "https://$VPS_PORTAINER_DOMAIN/api/users/admin/init" \ -H "Content-Type: application/json" \ -d "{\"Username\": \"$VPS_PORTAINER_USER\", \"Password\": \"$VPS_PORTAINER_PASS\"}")

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This curl -k request disables certificate validation during authentication and returns a privileged JWT. An attacker intercepting or impersonating the endpoint could steal credentials and tokens for full Portainer administration.
Content: Scanner excerpt · SKILL.md (reported line 365)May include surrounding context.
md
done # Obter token JWT para validar TOKEN=$(curl -k -s -X POST "https://$VPS_PORTAINER_DOMAIN/api/auth" \ -H "Content-Type: application/json" \ -d "{\"username\":\"$VPS_PORTAINER_USER\",\"password\":\"$VPS_PORTAINER_PASS\"}" | jq -r .jwt)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: Although this status check does not send a password directly, curl -k still trains operators to ignore TLS failures and accept spoofed endpoints for management traffic. In an administrative workflow, normalizing insecure transport weakens the security posture of subsequent authenticated requests.
Content: Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.
Verificação:

bash
curl -k -s "https://$VPS_PORTAINER_DOMAIN/api/status" | jq . # Esperado: JSON com Version e InstanceID echo "Portainer acessível em: https://$VPS_PORTAINER_DOMAIN"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This is another instance of disabled TLS verification during API authentication against Portainer. Because the resulting token is used for administrative actions, compromise of this exchange can lead to full control of deployed infrastructure.
Content: Scanner excerpt · SKILL.md (reported line 772)May include surrounding context.
bash
# 1. Obter token TOKEN=$(curl -k -s -X POST "https://$VPS_PORTAINER_DOMAIN/api/auth" \ -H "Content-Type: application/json" \ -d "{\"username\":\"$VPS_PORTAINER_USER\",\"password\":\"$VPS_PORTAINER_PASS\"}" | jq -r .jwt)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: Listing endpoints with a bearer token over a TLS session that is not being verified exposes management metadata and the token itself to interception. This is dangerous because it helps an attacker enumerate and then control cluster targets.
Content: Scanner excerpt · SKILL.md (reported line 777)May include surrounding context.
md
-d "{\"username\":\"$VPS_PORTAINER_USER\",\"password\":\"$VPS_PORTAINER_PASS\"}" | jq -r .jwt) # 2. Listar endpoints (stacks) curl -k -s "https://$VPS_PORTAINER_DOMAIN/api/endpoints" \ -H "Authorization: Bearer $TOKEN" | jq '.[].Id' # 3. Deploy stack via API (exemplo)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Submitting stack deployment requests with curl -k allows administrative actions and potentially sensitive stack content to be sent to an unverified endpoint. In context, this can be exploited for credential theft, malicious deployment, or redirection of management actions.
Content: Scanner excerpt · SKILL.md (reported line 781)May include surrounding context.
md
-H "Authorization: Bearer $TOKEN" | jq '.[].Id' # 3. Deploy stack via API (exemplo) curl -k -s -X POST "https://$VPS_PORTAINER_DOMAIN/api/stacks/create/swarm/string?endpointId=1" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: This troubleshooting section again recommends curl -k, reinforcing insecure practices around the management API. Even in diagnostics, bypassing TLS verification can hide certificate misconfiguration and expose operators to spoofed responses from attacker-controlled endpoints.
Content: Scanner excerpt · SKILL.md (reported line 875)May include surrounding context.
docker service logs traefik_traefik 2>&1 | grep -i "acme|certificate|error"

Verificar se porta 80 está acessível externamente

curl -sI http://SEU_DOMINIO

text
### Portainer API não responde

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description limits the skill to production VPS setup with Docker Swarm, Traefik v3, Portainer CE, and overlay networking. The document later provisions a full PostgreSQL database plus Evolution API and Redis stack, which are separate hosted workloads rather than core VPS/bootstrap components.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill performs extensive privileged system modifications—package upgrades, hostname changes, daemon configuration, service enablement, and stack deployment—but does not prominently warn that it will alter the host broadly and automatically. In this context, insufficient disclosure can lead operators to run it on the wrong server or without change control, causing availability and integrity issues.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The claim that all steps are idempotent and safe to rerun is inaccurate; commands like docker swarm init, network creation, admin initialization, database creation, and stack resets can fail or produce unintended state changes on re-execution. In a root-level automation skill for production infrastructure, misleading operators into rerunning destructive or stateful commands can cause outages, credential resets, and configuration drift.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
bash
# Atualizar sistema sudo apt-get update && sudo apt-get upgrade -y # Instalar utilitários essenciais sudo apt-get install -y apt-utils apparmor-utils curl jq htpasswd ca-certificates gnupg lsb-release

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
bash
# Atualizar sistema sudo apt-get update && sudo apt-get upgrade -y # Instalar utilitários essenciais sudo apt-get install -y apt-utils apparmor-utils curl jq htpasswd ca-certificates gnupg lsb-release

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
bash
# Atualizar sistema sudo apt-get update && sudo apt-get upgrade -y # Instalar utilitários essenciais sudo apt-get install -y apt-utils apparmor-utils curl jq htpasswd ca-certificates gnupg lsb-release

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
bash
# Atualizar sistema sudo apt-get update && sudo apt-get upgrade -y # Instalar utilitários essenciais sudo apt-get install -y apt-utils apparmor-utils curl jq htpasswd ca-certificates gnupg lsb-release

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Chaining Abuse

Chaining Abuse

Credential Access

Credential Access

Credential Access

Credential Access

Chaining Abuse

Chaining Abuse

Docker Socket Access

Docker Socket Access

Docker Socket Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Verificar se porta 80 está acessível externamente

Description-Behavior Mismatch

Missing User Warnings

Intent-Code Divergence

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Static analysis