initial-traefik

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:36 AM UTC
• Version: 1.0.0

Overview

The skill sets up Traefik as advertised, but its default templates expose sensitive Docker and dashboard access in ways users should review before installing.

Review before installing. Use a Docker socket proxy or file provider instead of mounting /var/run/docker.sock directly, disable api.insecure, keep the dashboard off public networks, require authentication and HTTPS, restrict admin routes by IP or VPN, and pin container images and helper dependencies.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/docker-compose.yml:17

Finding

Traefik Management API and Dashboard Exposed Without Authentication or TLS

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: assets/docker-compose.yml:10

Finding

Docker Daemon Socket Mount Creates a Host Privilege-Escalation Boundary

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/examples.md:138

Finding

Runtime Installation of Unpinned Third-Party Package and Mutable Container Image

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

This finding is substantively the same issue as the prior socket-mount warning: exposing the Docker socket to the Traefik container creates a high-value path for container and infrastructure discovery, and potentially broader compromise if combined with another flaw. In the context of an internet-facing reverse proxy, that dependency is especially sensitive because the proxy is more likely to process untrusted traffic.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

- "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
    command:
      - --api=true

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Mounting /var/run/docker.sock into a container gives that container visibility and influence over the Docker daemon; read-only reduces write risk but still exposes sensitive metadata and expands the blast radius if Traefik is compromised. The skill presents this privileged mount as a default without warning about the trust and host-level security implications.

Content

No source excerpt is available for this finding.

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Mounting /var/run/docker.sock into a container gives that container visibility into and control over the Docker daemon. Even when mounted read-only, the socket is still a powerful Docker API endpoint rather than a regular file, so compromise of Traefik could let an attacker enumerate containers, extract metadata, and potentially gain host-level control through the Docker API.

Content

Scanner excerpt · assets/docker-compose.yml (reported line 12)May include surrounding context.

yaml

- "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
      - traefik-data:/traefik
    command:

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Mounting /var/run/docker.sock into the Traefik container grants the container visibility and effective control over the Docker daemon, which can be leveraged for host-level compromise if Traefik or a related path is exploited. In this skill's context, the risk is elevated because the example also enables the Docker provider and dashboard routing, increasing the attack surface around a highly privileged container.

Content

Scanner excerpt · references/examples.md (reported line 101)May include surrounding context.

md

traefik:
    image: traefik:v3.0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command:
      - --api=true
      - --providers.docker=true

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

Quick Start

1. Create Configuration

bash

mkdir -p ~/.docker/compose

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enables Traefik's API and dashboard and later shows ways to route the dashboard over HTTP, but it does not warn that this exposes administrative and topology information unless explicitly restricted. In a reverse-proxy setup, exposing the dashboard can aid reconnaissance and, if misconfigured further, permit administrative access from untrusted networks.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/examples.md (reported line 135)May include surrounding context.

traefik-auth: basicAuth: users: - admin:$2y$05$YQ6ZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZ

text

Generate password:

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/features.md (reported line 163)May include surrounding context.

traefik-auth: basicAuth: users: - admin:$2y$05$YQ6ZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZ

text

Generate password:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example explicitly enables Traefik's insecure dashboard/API with --api.insecure=true, which exposes administrative and operational endpoints over HTTP without authentication. Although the comment says 'for dev only,' the snippet is presented as a ready-to-copy feature example and the warning is too weak, making accidental deployment to shared or internet-reachable environments likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The summary explicitly enables the Traefik API dashboard, DEBUG-level logs, access logs, and Prometheus metrics, but does not warn that these features can expose administrative endpoints, internal routing details, request metadata, and operational telemetry if reachable by untrusted users. In the context of a reverse proxy managing multiple Docker services, exposing observability and management surfaces without access-control guidance increases the chance of information disclosure and follow-on compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document publishes a direct public-style dashboard URL using nip.io without any warning that the Traefik dashboard is a sensitive administrative interface. If deployed as written, this can expose route configuration, backend service details, and management capabilities to anyone who can reach the host, which is especially risky for an internet-facing reverse proxy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file content is fully presented in Chinese, including headings, instructions, and operational guidance, with no indication that the user selected this language. This can violate a language-choice policy when a skill forces a specific language or locale without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.