Security audit
Security checks across malware telemetry and agentic risk
The skill has a legitimate server-patching purpose, but it can make broad infrastructure changes and has unsafe credential, sudo, and command-handling patterns users should review carefully.
Install only if you are prepared to review and harden the scripts first. Use a dedicated low-privilege PatchMon account, verified HTTPS, tightly scoped sudo or root-owned wrapper scripts, explicit host allowlists, dry-run by default, and manual confirmation before Docker restarts, pruning, or fleet-wide patching.
# Authenticate with PatchMon
echo "Authenticating with PatchMon..."
TOKEN=$(curl -s -k -X POST "$PATCHMON_URL/api/auth/login" \
-H "Content-Type: application/json" \
-d "{\"username\":\"$PATCHMON_USERNAME\",\"password\":\"$PATCHMON_PASSWORD\"}" \
| jq -r '.token // .accessToken // empty')### Step 3: Configure Passwordless Sudo (CRITICAL SECURITY STEP) **⚠️ Security Warning:** Passwordless sudo is required for automation but poses security risks. We configure it with **minimal permissions** - only for specific commands needed for patching. **On each target host, run as root or with sudo:**
}
echo "Step 3/5: Pulling updated Docker images..."
ssh "$HOST" "cd $DOCKER_PATH && sudo docker images --format '{{.Repository}}:{{.Tag}}' | grep -v '<none>' | xargs -r -L1 sudo docker pull" || {
echo "WARNING: Some image pulls failed (continuing anyway)"
}}
echo "Step 3/5: Pulling updated Docker images..."
ssh "$HOST" "cd $DOCKER_PATH && sudo docker images --format '{{.Repository}}:{{.Tag}}' | grep -v '<none>' | xargs -r -L1 sudo docker pull" || {
echo "WARNING: Some image pulls failed (continuing anyway)"
}}
echo "Step 4/5: Pulling compose images..."
ssh "$HOST" "cd $DOCKER_PATH && sudo docker compose pull" || {
echo "ERROR: Docker compose pull failed on $HOST"
exit 1
}}
echo "Step 5/5: Recreating containers..."
ssh "$HOST" "cd $DOCKER_PATH && sudo docker compose up -d" || {
echo "ERROR: Docker compose up failed on $HOST"
exit 1
}}
echo "Step 3/5: Pulling updated Docker images..."
ssh "$HOST" "cd $DOCKER_PATH && sudo docker images --format '{{.Repository}}:{{.Tag}}' | grep -v '<none>' | xargs -r -L1 sudo docker pull" || {
echo "WARNING: Some image pulls failed (continuing anyway)"
}}
echo "Step 4/5: Pulling compose images..."
ssh "$HOST" "cd $DOCKER_PATH && sudo docker compose pull" || {
echo "ERROR: Docker compose pull failed on $HOST"
exit 1
}60/60 vendors flagged this skill as clean.
No suspicious patterns detected.