Security audit
Publish Website Traefik
Security checks across malware telemetry and agentic risk
Overview
The skill is for publishing static websites with Docker and Traefik, but its scripts give broad host-level deployment and deletion power without enough input validation or cleanup containment.
Install only on a host intended for public Docker-based website deployments. Deploy a dedicated build directory with no secrets, validate subdomains before use, review the generated Docker Compose file, and constrain deletion to known skill-owned temporary directories before relying on the delete script.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.