Lu Auto Deploy

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:11 AM UTC
• Version: 1.0.0

Overview

This skill is a Docker deployment helper, but its templates expose powerful services and broad host access without enough scoping or safety guidance.

Review before installing. Use this only if you are comfortable editing the generated Docker commands: pin image versions or digests, bind sensitive services to localhost or a private admin network, avoid exposing Portainer directly, avoid raw Docker socket access where possible, narrow File Browser mounts to a dedicated directory, and require an explicit dry run before any deployment is executed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:133

Finding

Unrestricted Docker Socket Exposure Grants Effective Host Control

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:133
Vulnerability Type: Docker daemon socket exposed to a container
Risk Level: Critical

Vulnerable Code:

bash

docker run -d --name portainer -p 9000:9000 -v /var/run/docker.sock:/var/run/docker.sock -v portainer-data:/data --restart unless-stopped portainer/portainer-ce:latest

Technical Analysis

The deployment command mounts the host Docker daemon socket directly into the Portainer container. Access to /var/run/docker.sock generally provides control over the Docker daemon and is functionally equivalent to root-level host access.

A process controlling the socket can create privileged containers, mount arbitrary host directories, access secrets stored in other containers, alter running workloads, and modify host files through bind mounts. The risk is compounded because Portainer is published on all host interfaces and uses a mutable latest image tag.

Attack Path

1. An attacker reaches the Portainer service through TCP port 9000.
2. The attacker exploits a Portainer vulnerability, compromises an administrator account, or abuses an insecure initial configuration.
3. The compromised service communicates with the mounted Docker socket.
4. The attacker creates a privileged container or one that bind-mounts the host root filesystem.
5. The attacker reads or modifies host files, extracts credentials, accesses other containers, or establishes host-level control.

Impact Assessment

Successful exploitation can provide effective root-level control of the Docker host. The affected scope includes host files, Docker-managed secrets and volumes, all containers controlled by the daemon, attached networks, and data reachable from the host.

Remediation

View remediation

Remediation Suggestions

• Do not mount the raw Docker socket unless it is strictly necessary.
• Prefer a restricted Docker socket proxy that exposes only the minimum API operations required by Portainer.
• Run management interfaces on a dedicated administrative network and bind them to a trusted address rather than all interfaces.
• Require strong authentication, protect initial setup, and place the interface behind TLS and network allowlisting.
• Pin the Portainer image to a reviewed version and immutable digest.
• Apply defense-in-depth controls such as a read-only root filesystem, dropped Linux capabilities, no-new-privileges, and host firewall rules.
• Monitor Docker daemon API activity for unexpected privileged-container creation and host bind mounts.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:136

Finding

File Browser Receives Excessive Read-Write Access to the NAS Volume

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:136
Vulnerability Type: Overly broad host filesystem mount
Risk Level: High

Vulnerable Code:

bash

docker run -d --name file-browser -p 8080:80 -v /vol1/1000:/srv --restart unless-stopped filebrowser/filebrowser:latest

Technical Analysis

The command bind-mounts the entire /vol1/1000 host directory into the File Browser container as /srv. Because the mount is not marked read-only, the service can read, create, modify, and delete all files accessible through that host path.

This violates least privilege because a file-management service should receive access only to explicitly selected directories. Any authentication failure, compromised account, application vulnerability, or malicious upstream image could turn the broad mount into access to unrelated user data.

Attack Path

1. An attacker reaches File Browser through published TCP port 8080.
2. The attacker obtains valid credentials, abuses weak or default setup, or exploits a vulnerability in the service.
3. The attacker browses the mounted /srv directory.
4. Because /srv maps to /vol1/1000, the attacker reads or downloads unrelated files stored throughout that volume.
5. With write access, the attacker can alter, encrypt, replace, or delete those files.

Impact Assessment

Successful exploitation can compromise the confidentiality, integrity, and availability of all data under /vol1/1000 that the Docker daemon can expose. Potential consequences include bulk data disclosure, destructive deletion, ransomware-style encryption, and modification of files consumed by other applications.

Remediation

View remediation

Remediation Suggestions

• Replace the broad mount with a dedicated, narrowly scoped directory, such as /vol1/1000/shared-files:/srv.
• Add :ro when users do not require write access.
• Run the container under a non-root UID and GID with limited host filesystem permissions.
• Separate sensitive data into directories that are never mounted into the service.
• Bind the web interface to localhost or a trusted management interface and protect it with TLS, strong authentication, and network access controls.
• Pin the image to a reviewed version and immutable digest.
• Maintain tested backups that the container cannot modify or delete.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:73

Finding

Mutable Latest Image Tags Permit Unreviewed Dependency Changes

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:73, SKILL.md:83, SKILL.md:114, SKILL.md:133, SKILL.md:136, and SKILL.md:139
Vulnerability Type: Unpinned container dependencies
Risk Level: High

Vulnerable Code:

yaml

image: jellyfin/jellyfin:latest

yaml

image: deluan/navidrome:latest

yaml

image: grafana/grafana:latest

bash

docker run -d --name portainer -p 9000:9000 -v /var/run/docker.sock:/var/run/docker.sock -v portainer-data:/data --restart unless-stopped portainer/portainer-ce:latest

bash

docker run -d --name file-browser -p 8080:80 -v /vol1/1000:/srv --restart unless-stopped filebrowser/filebrowser:latest

bash

docker run -d --name vaultwarden -p 8000:80 -v vaultwarden-data:/data --restart unless-stopped vaultwarden/server:latest

Technical Analysis

The latest tag is mutable and does not identify a fixed, reviewed artifact. Repeating the same deployment command at different times can therefore execute different image contents without a corresponding change to the Skill.

If an upstream repository is compromised, publishes a defective release, or reassigns the tag, a subsequent pull can introduce unreviewed code. The consequences are especially severe for Portainer because it receives the Docker socket and for File Browser because it receives a broad host filesystem mount.

Attack Path

1. An upstream image account, registry, build pipeline, or mutable tag is compromised or changed.
2. An administrator deploys the template on a new host or pulls an updated latest image.
3. Docker downloads and executes the changed artifact without verifying a project-approved digest.
4. Malicious or vulnerable image code accesses its assigned ports, volumes, or Docker socket.
5. The code steals data, alters workloads, or uses exposed privileges to compromise the host.

Impact Assessment

The affected scope depends on e ...[truncated 241 chars]

Remediation

View remediation

Remediation Suggestions

• Replace every latest reference with an explicitly reviewed version.
• For reproducible deployments, pin each image by immutable digest, for example image: repository/name@sha256:....
• Use automated vulnerability and provenance scanning before approving image updates.
• Verify signatures or attestations where supported and restrict deployments to trusted registries.
• Introduce updates through a controlled review and staging process rather than automatically following mutable tags.
• Record approved versions and digests in the deployment templates and maintain a documented rollback procedure.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:75

Finding

Administrative and Data Services Are Published on All Host Interfaces

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:75-77, SKILL.md:85-87, SKILL.md:107-109, SKILL.md:116-118, SKILL.md:130, SKILL.md:133, SKILL.md:136, and SKILL.md:139
Vulnerability Type: Insecure network exposure
Risk Level: High

Vulnerable Code:

yaml

ports:
  - "8096:8096"

yaml

ports:
  - "4533:4533"

yaml

ports:
  - "3001:3001"

yaml

ports:
  - "3000:3000"

bash

docker run -d --name uptime-kuma -p 3001:3001 -v uptime-kuma-data:/app/data --restart unless-stopped louislam/uptime-kuma:1

bash

docker run -d --name portainer -p 9000:9000 -v /var/run/docker.sock:/var/run/docker.sock -v portainer-data:/data --restart unless-stopped portainer/portainer-ce:latest

bash

docker run -d --name file-browser -p 8080:80 -v /vol1/1000:/srv --restart unless-stopped filebrowser/filebrowser:latest

bash

docker run -d --name vaultwarden -p 8000:80 -v vaultwarden-data:/data --restart unless-stopped vaultwarden/server:latest

Technical Analysis

Docker port mappings without an explicit host address normally bind to all host interfaces. The templates consequently expose monitoring, media, file-management, container-administration, and password-management services beyond the local host.

The Skill does not include corresponding firewall restrictions, TLS termination, reverse-proxy controls, or interface allowlisting. Exposure is particularly dangerous for Portainer, which controls the Docker daemon, File Browser, which can access a broad NAS path, and Vaultwarden, which handles sensitive credentials.

Attack Path

1. A remote party identifies a reachable host interface and scans the published ports.
2. The party connects directly to a service login, setup page, or application endpoint.
3. The party exploits weak credentials, an incomplete initial setup, a service vulnerability, or insecure plaintext transport. ...[truncated 585 chars]

Remediation

View remediation

Remediation Suggestions

• Bind services to localhost by default, such as 127.0.0.1:9000:9000, unless remote exposure is explicitly required.
• Place remotely accessed services behind a hardened reverse proxy with TLS, authentication, request limits, and security headers.
• Restrict management services to a dedicated VLAN, VPN, or allowlisted administrative subnet.
• Configure host and upstream firewalls to deny untrusted access to published ports.
• Do not expose Portainer directly to the Internet.
• Protect initial-setup endpoints and require strong, unique credentials with multifactor authentication where available.
• Document the network exposure created by each template and require explicit user confirmation before publishing externally reachable ports.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Mounting /var/run/docker.sock into a container gives that container effective control over the host Docker daemon, which is commonly equivalent to root-level control of the host. In this skill, the command is presented as a quick deployment recipe without any warning about the privilege implications, making dangerous host compromise pathways easy to introduce.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

docker run -d --name uptime-kuma -p 3001:3001 -v uptime-kuma-data:/app/data --restart unless-stopped louislam/uptime-kuma:1

# Portainer
docker run -d --name portainer -p 9000:9000 -v /var/run/docker.sock:/var/run/docker.sock -v portainer-data:/data --restart unless-stopped portainer/portainer-ce:latest

# File Browser
docker run -d --name file-browser -p 8080:80 -v /vol1/1000:/srv --restart unless-stopped filebrowser/filebrowser:latest

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The skill is explicitly framed as auto-deploy and is designed to help users rapidly deploy services, which encourages autonomous operational decision-making in a high-impact domain. In the surrounding context, broad triggers and lack of confirmation amplify the risk that deployment actions are suggested or performed without sufficient user intent validation.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

# lu-auto-deploy

Docker 自动化部署技能 - 帮助你快速部署常见的 Docker 服务。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger keyword 部署 is extremely broad and can match ordinary conversation about deployment, increasing the chance that the skill activates unexpectedly. Because the skill's purpose is to generate and run file-writing and container-launching commands, accidental activation can lead to unintended system changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Advertising batch deployment without warning about cumulative resource use, network exposure, and multiple simultaneously started services increases the risk of disruptive changes. A user may trigger several containers at once without understanding port conflicts, storage consumption, or the security posture of the stack.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill provides commands that create directories, write docker-compose.yml, and start containers, but it does not clearly warn that these actions modify the local filesystem and launch services. In practice, users may treat the skill as informational while it is actually prescribing operationally impactful actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · _meta.json (reported line 2)May include surrounding context.

json

{
  "name": "lu-auto-deploy",
  "version": "1.0.0",
  "description": "Docker 自动化部署技能",
  "author": "jesson1222-ship-it",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest sets the skill language to "zh-CN", which can force a specific language/locale behavior without any indication that users can choose another language. Under the policy, locale constraints should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

All user-facing instructions, examples, and trigger phrases are presented only in Chinese, which implies a fixed language behavior. There is no opt-in, alternative language option, or statement that the skill is intentionally limited to a Chinese-speaking environment.

Content

No source excerpt is available for this finding.