T09 · Insecure Skill Coding Practices
Error
- Location
scripts/portainer_manager.py:11- Finding
Privileged Portainer API Token Transmitted Without TLS Certificate Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Portainer
Security checks for vulnerabilities and agentic risk
Overview
This Portainer skill is mostly transparent about managing Docker infrastructure, but it exposes very powerful infrastructure controls with weak safety boundaries and insecure TLS handling.
Install only if you trust the operator context and can limit the Portainer API token to the least privileges needed. Avoid using this against production infrastructure until TLS verification is fixed, raw Docker proxying is restricted or removed, and destructive actions require explicit confirmation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
package.json:5- Finding
Python Dependencies Declared and Installed Through Unsafe, Inconsistent Mechanisms
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: urllib3== --hash=sha256: ``` 5. Install dependencies using `pip install --require-hashes -r requirements.txt`. 6. Use a dedicated virtual environment or isolated container layer instead of `--break-system-packages`. 7. Commit an appropriate lockfile and review dependency updates before merging them. 8. Use a trusted package index and retain installer logs or a software bill of materials for release builds. 9. Add automated dependency scanning for both Python and npm metadata. 10. If `package.json` is required only for OpenClaw metadata, keep it free of npm dependencies unless JavaScript packages are genuinely needed. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (33)
Tainted flow: 'headers' from os.environ.get (line 129, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python try: token = get_portainer_api_token() headers = {"X-API-Key": token, "Content-Type": "application/json"} response = requests.get(f"{PORTAINER_API_URL}/endpoints", headers=headers, timeout=10, verify=False) response.raise_for_status() output_data = response.json() print(json.dumps(output_data, indent=2), flush=True)
Tainted flow: 'headers' from os.environ.get (line 129, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python try: token = get_portainer_api_token() headers = {"X-API-Key": token, "Content-Type": "application/json"} response = requests.get(f"{PORTAINER_API_URL}/stacks", headers=headers, timeout=10, verify=False) response.raise_for_status() stacks = response.json() if environment_id:
Tainted flow: 'headers' from os.environ.get (line 129, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python try: token = get_portainer_api_token() headers = {"X-API-Key": token, "Content-Type": "application/json"} response = requests.get(f"{PORTAINER_API_URL}/stacks/{stack_id}", headers=headers, timeout=10, verify=False) response.raise_for_status() output_data = response.json()
Tainted flow: 'headers' from os.environ.get (line 129, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python # Also fetch the stack file content if possible try: file_response = requests.get(f"{PORTAINER_API_URL}/stacks/{stack_id}/file", headers=headers, timeout=10, verify=False) if file_response.status_code == 200: output_data["StackFileContent"] = file_response.json().get("StackFileContent", "") except:
Tainted flow: 'url' from os.environ.get (line 131, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers = {"X-API-Key": token, "Content-Type": "application/json"} url = f"{PORTAINER_API_URL}/stacks/create/standalone/string?endpointId={endpoint_id}" payload = {"name": name, "stackFileContent": stack_content, "env": []} response = requests.post(url, headers=headers, json=payload, timeout=30, verify=False) response.raise_for_status() output_data = response.json() print(json.dumps(output_data, indent=2), flush=True)
Tainted flow: 'url' from os.environ.get (line 131, credential/environment) → requests.put (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python "env": [], "prune": prune } response = requests.put(url, headers=headers, json=payload, timeout=30, verify=False) response.raise_for_status() output_data = response.json() print(json.dumps(output_data, indent=2), flush=True)
Tainted flow: 'url' from os.environ.get (line 131, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Unlike the other TT3 findings, this request is part of a generic raw Docker API proxy that accepts arbitrary user-supplied paths and forwards authenticated requests through Portainer. That greatly expands the trust boundary and can turn the skill into a general-purpose privileged API tunnel, enabling unauthorized or destructive Docker operations if exposed to untrusted prompts or users.
- Content
python url = f"{PORTAINER_API_URL}/endpoints/{environment_id}/docker{path}" if method.upper() == "GET": response = requests.get(url, headers=headers, params=payload, timeout=10, verify=False) elif method.upper() == "POST": response = requests.post(url, headers=headers, json=payload, timeout=10, verify=False) elif method.upper() == "DELETE":
Tainted flow: 'url' from os.environ.get (line 131, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
This POST path is part of the same unrestricted Docker API proxy and allows arbitrary authenticated write operations against Docker through Portainer. In practice, this can be abused to create containers, mount sensitive host paths, alter networks, or otherwise take over the managed environment.
- Content
python if method.upper() == "GET": response = requests.get(url, headers=headers, params=payload, timeout=10, verify=False) elif method.upper() == "POST": response = requests.post(url, headers=headers, json=payload, timeout=10, verify=False) elif method.upper() == "DELETE": response = requests.delete(url, headers=headers, json=payload, timeout=10, verify=False) else:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Prerequisites - An active [Portainer CE](https://www.portainer.io/) instance. - An **API Access Token** from your Portainer user settings. - OpenClaw installed and running. ## Installation
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Prerequisites - An active [Portainer CE](https://www.portainer.io/) instance. - An **API Access Token** from your Portainer user settings. - OpenClaw installed and running. ## Installation
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill exposes raw Docker API execution through Portainer and labels it only as 'Advanced' without explaining that it can directly control containers, images, networks, volumes, and potentially host-adjacent resources. In the context of infrastructure management, this is especially dangerous because a broad proxy endpoint can be used for highly privileged actions leading to outage, data destruction, lateral movement, or container escape enabling conditions.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims to manage Portainer environments and stacks, but it also exposes a generic raw Docker API proxy. That is significantly more powerful than the stated purpose and can enable full container-host compromise patterns, destructive actions, secret access, and persistence depending on Docker daemon privileges. In this skill context, that mismatch makes the capability especially dangerous because users may not realize they are granting near-administrative infrastructure control.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The generic Docker API executor permits potentially destructive operations with no warnings, confirmation, or policy gating. Because Docker APIs can create privileged containers, remove workloads, alter networking, and expose host resources, this is highly dangerous in an agent-exposed interface.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises deployment, removal, and raw Docker API execution capabilities without any guidance to require explicit user confirmation for destructive or low-level actions. In an agentic context, this increases the chance of accidental infrastructure changes, service disruption, or abuse of powerful functionality through prompt manipulation or ambiguous user requests.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises high-impact capabilities involving environment access and network-reachable infrastructure operations, but it does not declare any explicit tool scope or permission boundaries. In a skill that can manage Portainer and proxy Docker API calls, missing scope metadata increases the risk of overbroad invocation, unsafe delegation, and misuse of privileged credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill exposes a destructive operation, stack deletion, without any warning, confirmation requirement, or safety guidance. Because stack removal can cause service outage and data loss in live environments, describing it as a normal function without guardrails makes accidental or unauthorized destructive use more likely.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
TLS certificate verification is explicitly disabled for requests carrying the Portainer API key. This allows man-in-the-middle interception or spoofing of the Portainer server, potentially exposing credentials and permitting tampering with responses and administrative actions.
- Content
python try: token = get_portainer_api_token() headers = {"X-API-Key": token, "Content-Type": "application/json"} response = requests.get(f"{PORTAINER_API_URL}/endpoints", headers=headers, timeout=10, verify=False) response.raise_for_status() output_data = response.json() print(json.dumps(output_data, indent=2), flush=True)
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Disabling TLS verification on authenticated API requests undermines the security of the entire Portainer session. An attacker on the network could impersonate the server, harvest the API key, and control the data returned to the skill.
- Content
python try: token = get_portainer_api_token() headers = {"X-API-Key": token, "Content-Type": "application/json"} response = requests.get(f"{PORTAINER_API_URL}/stacks", headers=headers, timeout=10, verify=False) response.raise_for_status() stacks = response.json() if environment_id:
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This insecure default affects stack inspection requests that include privileged authentication headers. With verify=False, the client cannot authenticate the server identity, enabling interception of sensitive stack metadata and credentials in transit.
- Content
python try: token = get_portainer_api_token() headers = {"X-API-Key": token, "Content-Type": "application/json"} response = requests.get(f"{PORTAINER_API_URL}/stacks/{stack_id}", headers=headers, timeout=10, verify=False) response.raise_for_status() output_data = response.json()
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Fetching stack file content over a connection that does not verify TLS certificates risks disclosure of full compose files, which may contain secrets, environment values, image references, and infrastructure details. Because this is admin-plane data, compromise impact is substantial.
- Content
python # Also fetch the stack file content if possible try: file_response = requests.get(f"{PORTAINER_API_URL}/stacks/{stack_id}/file", headers=headers, timeout=10, verify=False) if file_response.status_code == 200: output_data["StackFileContent"] = file_response.json().get("StackFileContent", "") except:
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest emphasizes deployment, status checks, and network management, but the implementation also supports stack deletion. While deletion may be legitimate for an admin tool, omitting that destructive capability from the framing can mislead users and downstream policy about the true risk of invoking the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
remove_stack performs an irreversible destructive action immediately, with no confirmation, dry-run, dependency check, or safeguard beyond a log message. In an agent setting, this increases the chance of accidental deletion due to prompt confusion, parameter mix-ups, or malicious instruction injection through user content.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
A destructive delete request is sent over a TLS connection with certificate validation disabled. That means an attacker able to intercept traffic could potentially spoof responses or capture the API key used to authorize deletions, compounding the risk.
- Content
python try: token = get_portainer_api_token() headers = {"X-API-Key": token, "Content-Type": "application/json"} response = requests.delete(f"{PORTAINER_API_URL}/stacks/{stack_id}", headers=headers, timeout=10, verify=False) response.raise_for_status() print(f"Successfully removed stack {stack_id}.", flush=True) return {"status": "success"}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python headers = {"X-API-Key": token, "Content-Type": "application/json"} url = f"{PORTAINER_API_URL}/stacks/create/standalone/string?endpointId={endpoint_id}" payload = {"name": name, "stackFileContent": stack_content, "env": []} response = requests.post(url, headers=headers, json=payload, timeout=30, verify=False) response.raise_for_status() output_data = response.json() print(json.dumps(output_data, indent=2), flush=True)
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Stack deployment sends potentially sensitive infrastructure configuration over a connection with verify=False. This can leak secrets embedded in compose content and let an attacker alter or replay deployment requests.
- Content
python headers = {"X-API-Key": token, "Content-Type": "application/json"} url = f"{PORTAINER_API_URL}/stacks/create/standalone/string?endpointId={endpoint_id}" payload = {"name": name, "stackFileContent": stack_content, "env": []} response = requests.post(url, headers=headers, json=payload, timeout=30, verify=False) response.raise_for_status() output_data = response.json() print(json.dumps(output_data, indent=2), flush=True)
Static analysis
No suspicious patterns detected.