initial-traefik

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:36 AM UTC
• Version: 1.0.0

Overview

The skill sets up Traefik as advertised, but its default templates expose sensitive Docker and dashboard access in ways users should review before installing.

Review before installing. Use a Docker socket proxy or file provider instead of mounting /var/run/docker.sock directly, disable api.insecure, keep the dashboard off public networks, require authentication and HTTPS, restrict admin routes by IP or VPN, and pin container images and helper dependencies.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/docker-compose.yml:17
• Finding: Traefik Management API and Dashboard Exposed Without Authentication or TLS<![CDATA[ ## Vulnerability Details **File Location**: `assets/docker-compose.yml:17-19`; `assets/traefik-dynamic.yml:3-8` **Vulnerability Type**: Unauthenticated management interface exposure **Risk Level**: High ### Vulnerable Code `assets/docker-compose.yml:17-19`: ```yaml # API & Dashboard - --api=true - --api.dashboard=true - --api.insecure=true ``` `assets/traefik-dynamic.yml:3-8`: ```yaml # Traefik Dashboard traefik: rule: "Host(`traefik.192.168.9.192.nip.io`)" service: api@internal entryPoints: - web ``` The insecure configuration is also presented as a feature in `references/features.md:7-14`. ### Technical Analysis The supplied deployment template enables Traefik's insecure API mode and routes the internal API/dashboard service through the plaintext `web` entry point. The router has no authentication, IP allowlist, or security middleware. Although insecure API mode normally creates a dedicated management entry point, the dynamic router separately makes `api@internal` reachable through published port 80. Consequently, access does not depend solely on whether port 8080 is published by Docker. The `.nip.io` hostname does not provide access control. A client can resolve the hostname normally or directly send the required `Host` header to the server IP. Because the route uses HTTP, management traffic and infrastructure metadata are also exposed to interception on an untrusted network. ### Attack Path 1. An attacker identifies a host running the supplied configuration and confirms that TCP port 80 is reachable. 2. The attacker requests `http://traefik.192.168.9.192.nip.io/` or sends `Host: traefik.192.168.9.192.nip.io` directly to the server IP. 3. Traefik matches the unauthenticated router and forwards the request to `api@internal`. 4. The attacker accesses dashboard and API endpoints without credentials. 5. The attacker enumerates routers, services, middlewares, entry points, backend nam ...[truncated 771 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove insecure API mode: ```yaml - --api=true - --api.dashboard=true - --api.insecure=false ``` 2. Route `api@internal` only through the TLS-enabled `websecure` entry point. 3. Add an authentication middleware using securely provisioned credentials or an external identity provider. 4. Add an `ipAllowList` middleware restricting access to trusted administration networks. 5. Enforce HTTP-to-HTTPS redirection and configure valid TLS certificates. 6. Restrict management access at the host firewall, load balancer, or VPN layer. 7. Replace the concrete private-address hostname with an explicit deployment variable. 8. Clearly separate development-only examples from production templates and make secure behavior the default. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: assets/docker-compose.yml:10
• Finding: Docker Daemon Socket Mount Creates a Host Privilege-Escalation Boundary<![CDATA[ ## Vulnerability Details **File Location**: `assets/docker-compose.yml:10-13` **Vulnerability Type**: Excessive access to the privileged Docker daemon API **Risk Level**: High ### Vulnerable Code ```yaml volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - ./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro - traefik-data:/traefik ``` The same mounting pattern is recommended in `SKILL.md:29-33` and `references/examples.md:97-102`. ### Technical Analysis The container receives the host Docker daemon socket at `/var/run/docker.sock`. The Docker daemon commonly runs with root-equivalent authority and can create privileged containers, mount host paths, manipulate networks, and access other containers. The `:ro` suffix controls filesystem mount semantics; it does not transform the Unix socket protocol into a read-only API. A process capable of connecting to the socket may still issue state-changing Docker API requests if the daemon authorizes them. Traefik legitimately requires limited Docker metadata access for automatic discovery, but direct access to the unrestricted daemon exceeds the minimum permissions needed. Exploitation requires an attacker to first gain code execution in the Traefik container or otherwise obtain the ability to communicate through its mounted socket. ### Attack Path 1. An attacker exploits a separate Traefik vulnerability, compromised plugin, or configuration weakness and gains code execution in the Traefik container. 2. The attacker opens the mounted `/var/run/docker.sock` Unix socket. 3. The attacker sends Docker API requests to create a new container. 4. The requested container is privileged or mounts the host root filesystem, such as `/`, into the container. 5. The attacker starts the container and modifies or reads the mounted host filesystem. 6. The attacker obtains root-equivalent control of the Docker host and can access other containers and their data. ### Impact Assessment Following co ...[truncated 531 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not mount the raw Docker socket directly into Traefik. 2. Deploy a Docker socket proxy that exposes only the minimum read operations required for service discovery. 3. Deny container-creation, execution, deletion, volume, secret, and write-capable API endpoints at the proxy. 4. Place the socket proxy on a dedicated internal network that is not exposed externally. 5. Run Traefik as a non-root user where supported and apply: - A read-only root filesystem - Dropped Linux capabilities - `no-new-privileges` - Seccomp and AppArmor or SELinux confinement 6. Keep Traefik patched and pin its image by immutable digest. 7. Consider using the file provider or another narrowly scoped discovery mechanism when automatic Docker discovery is unnecessary. 8. Document explicitly that `:ro` does not make Docker API access read-only. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/examples.md:138
• Finding: Runtime Installation of Unpinned Third-Party Package and Mutable Container Image<![CDATA[ ## Vulnerability Details **File Location**: `references/examples.md:138-140` **Vulnerability Type**: Unpinned runtime dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash docker run --rm -it python:3.11-alpine sh -c "pip install passlib && python -c 'from passlib.hash import bcrypt; print(\"admin:\" + bcrypt.hash(\"yourpassword\"))'" ``` ### Technical Analysis The documented password-generation command downloads and installs `passlib` at runtime without an exact version, package hash, lockfile, or reviewed artifact. The `python:3.11-alpine` container image is also referenced by a mutable tag rather than an immutable digest. Python package installation may execute package-controlled build or installation logic. Therefore, a compromised package release, registry account, dependency chain, package index, or mutable container image could cause code that was not present during audit to run when a user follows the example. No evidence shows that the current `passlib` package is malicious. The confirmed issue is the unsafe and non-reproducible dependency retrieval pattern. ### Attack Path 1. An attacker compromises a relevant package publication channel, dependency, registry account, or referenced container tag. 2. A user copies and runs the documented command. 3. Docker retrieves the current image associated with the mutable tag. 4. `pip install passlib` retrieves the current unpinned package and dependency set. 5. Attacker-controlled package installation or container code executes inside the temporary container. 6. The malicious code can access resources deliberately exposed to that container and perform network actions with the user's Docker environment. ### Impact Assessment The immediate container is temporary and the example does not mount host directories or the Docker socket, which limits direct host exposure. Nevertheless, a compromised dependency can execute arbitrary code inside the container, use its network access ...[truncated 263 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a trusted, preinstalled password-generation utility such as `htpasswd`. 2. If a container is required, pin the image by immutable digest rather than a mutable tag. 3. Pin `passlib` and all transitive dependencies to reviewed versions. 4. Require package hashes, for example through a hash-locked requirements file and `pip install --require-hashes`. 5. Build and scan a dedicated utility image in a controlled pipeline instead of installing packages interactively at runtime. 6. Run the utility container with: - No host mounts - No Docker socket - Dropped capabilities - A read-only root filesystem - Network disabled after all required artifacts have been pre-fetched and verified 7. Periodically review and update pinned artifacts through a controlled dependency-management process. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Docker Socket Access

High

• Category: Privilege Escalation

Content

- "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
    command:
      - --api=true

• Confidence: 99% confidence
• Finding: This finding is substantively the same issue as the prior socket-mount warning: exposing the Docker socket to the Traefik container creates a high-value path for container and infrastructure discovery, and potentially broader compromise if combined with another flaw. In the context of an internet-facing reverse proxy, that dependency is especially sensitive because the proxy is more likely to process untrusted traffic.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Mounting `/var/run/docker.sock` into a container gives that container visibility and influence over the Docker daemon; read-only reduces write risk but still exposes sensitive metadata and expands the blast radius if Traefik is compromised. The skill presents this privileged mount as a default without warning about the trust and host-level security implications.

Docker Socket Access

High

• Category: Privilege Escalation

Content

- "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
      - traefik-data:/traefik
    command:

• Confidence: 96% confidence
• Finding: Mounting /var/run/docker.sock into a container gives that container visibility into and control over the Docker daemon. Even when mounted read-only, the socket is still a powerful Docker API endpoint rather than a regular file, so compromise of Traefik could let an attacker enumerate containers, extract metadata, and potentially gain host-level control through the Docker API.

Docker Socket Access

High

• Category: Privilege Escalation

Content

traefik:
    image: traefik:v3.0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command:
      - --api=true
      - --providers.docker=true

• Confidence: 98% confidence
• Finding: Mounting `/var/run/docker.sock` into the Traefik container grants the container visibility and effective control over the Docker daemon, which can be leveraged for host-level compromise if Traefik or a related path is exploited. In this skill's context, the risk is elevated because the example also enables the Docker provider and dashboard routing, increasing the attack surface around a highly privileged container.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Quick Start

### 1. Create Configuration

```bash
mkdir -p ~/.docker/compose

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill enables Traefik's API and dashboard and later shows ways to route the dashboard over HTTP, but it does not warn that this exposes administrative and topology information unless explicitly restricted. In a reverse-proxy setup, exposing the dashboard can aid reconnaissance and, if misconfigured further, permit administrative access from untrusted networks.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

traefik-auth:
      basicAuth:
        users:
          - admin:$2y$05$YQ6ZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZ
```

Generate password:

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

traefik-auth:
      basicAuth:
        users:
          - admin:$2y$05$YQ6ZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZ
```

Generate password:

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The example explicitly enables Traefik's insecure dashboard/API with `--api.insecure=true`, which exposes administrative and operational endpoints over HTTP without authentication. Although the comment says 'for dev only,' the snippet is presented as a ready-to-copy feature example and the warning is too weak, making accidental deployment to shared or internet-reachable environments likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The summary explicitly enables the Traefik API dashboard, DEBUG-level logs, access logs, and Prometheus metrics, but does not warn that these features can expose administrative endpoints, internal routing details, request metadata, and operational telemetry if reachable by untrusted users. In the context of a reverse proxy managing multiple Docker services, exposing observability and management surfaces without access-control guidance increases the chance of information disclosure and follow-on compromise.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document publishes a direct public-style dashboard URL using nip.io without any warning that the Traefik dashboard is a sensitive administrative interface. If deployed as written, this can expose route configuration, backend service details, and management capabilities to anyone who can reach the host, which is especially risky for an internet-facing reverse proxy.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The file content is fully presented in Chinese, including headings, instructions, and operational guidance, with no indication that the user selected this language. This can violate a language-choice policy when a skill forces a specific language or locale without opt-in.

Static analysis

No suspicious patterns detected.