Dokploy

Manage Dokploy deployments, projects, applications, and domains via the Dokploy API.

Security Scan

The skill appears to implement a normal CLI for a Dokploy API, but there are inconsistencies in the declared metadata vs. the actual scripts (the API key and config file usage are not declared in the registry metadata) and the tool writes a persistent config file containing your API key to $HOME/.dokployrc.

Purpose & Capability

Name, description, SKILL.md and the scripts all align: this is a CLI to call a Dokploy API (projects, apps, domains, deployments). However the registry metadata at the top of the report claims "Required env vars: none" and "Primary credential: none", while .clawdhub/package.json and SKILL.md/scripts clearly require DOKPLOY_API_URL and DOKPLOY_API_KEY. That metadata mismatch is suspicious (likely packaging oversight) but the requested env vars themselves are coherent with the stated purpose.

Instruction Scope

Runtime instructions and scripts only call the Dokploy API (base $DOKPLOY_API_URL/api) using curl and parse JSON with jq. The scripts do read and write a local config file ($HOME/.dokployrc) to persist DOKPLOY_API_URL and DOKPLOY_API_KEY; they also prompt for confirmations on destructive actions. No instructions try to read unrelated system data or call unexpected external endpoints.

Install Mechanism

There is no install spec — the skill is instruction + shell scripts only (no downloads or package installs). This is lower-risk from an installer/execution viewpoint.

Credentials

The scripts require an API key (DOKPLOY_API_KEY) and URL (DOKPLOY_API_URL), which is appropriate for an API client, but the registry metadata omitted these. The CLI persists the API key to $HOME/.dokployrc in clear text (export lines). Storing secrets on disk is expected for a CLI but is sensitive — users should be aware the key ends up in their home directory. No unrelated credentials are requested.

Persistence & Privilege

The skill does not set always:true and does not request elevated or platform-wide privileges. It only writes/reads its own config file in the user's home directory and does not modify other skills or global agent settings.

What to consider before installing

This skill appears to be a straightforward CLI for a Dokploy API, but note two issues before installing: (1) the package/registry metadata failed to declare the required environment variables (DOKPLOY_API_URL and DOKPLOY_API_KEY) even though the scripts and SKILL.md require them — treat this as a packaging/integrity red flag and review the included scripts yourself; (2) the CLI will persist your API key in $HOME/.dokployrc (plain export lines), so only use an API key you trust to be stored on disk and restrict file permissions. Ensure you trust the Dokploy instance you point it at, have curl and jq installed, and inspect the scripts if you are in a sensitive or multi-tenant environment. If you need higher assurance, ask the publisher to correct the registry metadata and provide a signed/reviewed release.

Dokploy Skill

Interact with Dokploy's API to manage projects, applications, domains, and deployments.

Prerequisites

1. Dokploy instance running with API access
2. API Key generated from /settings/profile → "API/CLI Section"
3. Set the DOKPLOY_API_URL environment variable (default: http://localhost:3000)

Configuration

Set these environment variables or use the config command:

# Dokploy instance URL
export DOKPLOY_API_URL="https://your-dokploy-instance.com"

# Your API token
export DOKPLOY_API_KEY="your-generated-api-key"

# Or run the config command
dokploy-config set --url "https://your-dokploy-instance.com" --key "your-api-key"

Projects

List all projects

dokploy-project list

Get project details

dokploy-project get <project-id>

Create a new project

dokploy-project create --name "My Project" --description "Description here"

Update a project

dokploy-project update <project-id> --name "New Name" --description "Updated"

Delete a project

dokploy-project delete <project-id>

Applications

List applications in a project

dokploy-app list --project <project-id>

Get application details

dokploy-app get <application-id>

Create an application

dokploy-app create \
  --project <project-id> \
  --name "my-app" \
  --type "docker" \
  --image "nginx:latest"

Application types: docker, git, compose

Trigger deployment

dokploy-app deploy <application-id>

Get deployment logs

dokploy-app logs <application-id> --deployment <deployment-id>

List deployments

dokploy-app deployments <application-id>

Update application

dokploy-app update <application-id> --name "new-name" --env "KEY=VALUE"

Delete an application

dokploy-app delete <application-id>

Domains

List domains for an application

dokploy-domain list --application <application-id>

Get domain details

dokploy-domain get <domain-id>

Add a domain to an application

dokploy-domain create \
  --application <application-id> \
  --domain "app.example.com" \
  --path "/" \
  --port 80

Update a domain

dokploy-domain update <domain-id> --domain "new.example.com"

Delete a domain

dokploy-domain delete <domain-id>

Environment Variables

List environment variables for an application

dokploy-app env list <application-id>

Set environment variable

dokploy-app env set <application-id> --key "DATABASE_URL" --value "postgres://..."

Delete environment variable

dokploy-app env delete <application-id> --key "DATABASE_URL"

Utility Commands

Check API connection

dokploy-status

View current config

dokploy-config show

API Reference

Base URL: $DOKPLOY_API_URL/api

Endpoint	Method	Description
/project.all	GET	List all projects
/project.create	POST	Create project
/project.byId	GET	Get project by ID
/project.update	PATCH	Update project
/project.delete	DELETE	Delete project
/application.all	GET	List applications
/application.create	POST	Create application
/application.byId	GET	Get application by ID
/application.update	PATCH	Update application
/application.delete	DELETE	Delete application
/application.deploy	POST	Trigger deployment
/deployment.all	GET	List deployments
/deployment.byId	GET	Get deployment by ID
/deployment.logs	GET	Get deployment logs
/domain.all	GET	List domains
/domain.create	POST	Create domain
/domain.update	PATCH	Update domain
/domain.delete	DELETE	Delete domain

Notes

• All API calls require the x-api-key header
• Use jq for JSON parsing in scripts
• Some operations require admin permissions
• Deployment is asynchronous — use status endpoint to check progress