T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/api.md:160- Finding
Arbitrary Host Bind Mounts Violate the Documented Filesystem Boundary
- Content
View full analysis
- Remediation
View remediation
Security audit
wagmios
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Docker-management helper, but it gives agents high-impact container authority with several under-scoped safety gaps users should review first.
Install only if you trust the WAGMIOS backend and will use least-privilege, per-host API keys. Prefer loopback-only or HTTPS/VPN access for remote hosts, avoid broad docker-group membership for general users, review compose files and bind mounts before starting apps, and do not allow agents to print container environment values that may contain secrets.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/docker-install.md:78- Finding
Docker Group Membership Grants Root-Equivalent Access Beyond the Skill’s Needs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/api.md:3- Finding
Remote API Keys May Be Transmitted Over Plaintext HTTP
- Content
View full analysis
` header on all requests ``` Related instructions in `SKILL.md:40-44` are: ```text Every request requires the `X-API-Key` header. The user provides the key and base URL at runtime — do not store it. Base URL: http://localhost:5179 (user provides, may differ for remote hosts) Header: X-API-Key: ``` ### Technical Analysis Plain HTTP provides no confidentiality, server authentication, or integrity protection. Although HTTP on loopback may be acceptable under a constrained local threat model, the Skill explicitly supports remote and multi-machine endpoints without requiring HTTPS for those connections. Sending the mandatory `X-API-Key` header to a remote HTTP endpoint exposes the key to network observers and active man-in-the-middle attackers. An active attacker could also modify API responses, redirect operations, or impersonate a WAGMIOS server. ### Attack Path 1. The user supplies a remote WAGMIOS URL using `http://`. 2. The agent sends the scoped API key in the `X-API-Key` request header. 3. An adjacent-network or on-path attacker captures the unencrypted request. 4. The attacker extracts and replays the API key. 5. The attacker invokes every operation authorized by the key, such as inspecting containers, reading logs, creating containers, pulling images, or installing marketplace applications. 6. An active attacker may additionally alter responses to mislead the agent about operation results or available scopes. ### Impact Assessment The exposed privileges are determined by the stolen key’s scopes. A broadly scoped key could permit access to logs and configurations, container lifecycle control, image management, marketplace installati ...[truncated 184 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/api.md:83- Finding
System Metrics Endpoint Is Documented as Unauthenticated
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (46)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Delete Image
text DELETE /api/images/{id} Required Scope: images:writeRequires user confirmation before executing.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md sudo apt-get install ca-certificates curl gnupg lsb-release # Add Docker GPG key sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg # Add Docker repo
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md sudo apt-get install ca-certificates curl gnupg lsb-release # Add Docker GPG key sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg # Add Docker repo
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md sudo apt-get install ca-certificates curl gnupg lsb-release # Add Docker GPG key sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg # Add Docker repo
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md # Add Docker GPG key sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg # Add Docker repo echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md # Add Docker GPG key sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg # Add Docker repo echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md User: "Delete the postgres container" Agent: GET /api/auth/status Agent: GET /api/containers → find container ID Agent: DELETE /api/containers/{id}/delete → SCOPE_REQUIRED Agent: "I can't delete containers — your key is missing the `containers:delete` scope. To enable it: Settings → Agent Permissions → toggle ON → Save. Let me know when you've enabled it."
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md User: "Delete the postgres container" Agent: GET /api/auth/status Agent: GET /api/containers → find container ID Agent: DELETE /api/containers/{id}/delete → SCOPE_REQUIRED Agent: "I can't delete containers — your key is missing the `containers:delete` scope. To enable it: Settings → Agent Permissions → toggle ON → Save. Let me know when you've enabled it."
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md User: "Delete the postgres container" Agent: GET /api/auth/status Agent: GET /api/containers → find container ID Agent: DELETE /api/containers/{id}/delete → SCOPE_REQUIRED Agent: "I can't delete containers — your key is missing the `containers:delete` scope. To enable it: Settings → Agent Permissions → toggle ON → Save. Let me know when you've enabled it."
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md User: "Delete the postgres container" Agent: GET /api/auth/status Agent: GET /api/containers → find container ID Agent: DELETE /api/containers/{id}/delete → SCOPE_REQUIRED Agent: "I can't delete containers — your key is missing the `containers:delete` scope. To enable it: Settings → Agent Permissions → toggle ON → Save. Let me know when you've enabled it."
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: wagmios description: Give your OpenClaw agent a homelab. Use when managing Docker containers, installing marketplace apps, or any Docker-related tasks on behalf of the user. Scope-based API key permissions — agent can only do what the key allows. On Linux, Docker requires sudo — without root access, WAGMIOS is the only safe interface for agent homelab control. Supports multi-machine management — one agent can manage multiple WAGMIOS instances across different hosts, each with its own scoped key. Requires X-API-Key header on every request (user provides at runtime). Includes Docker installation check and startup validation. --- # WAGMIOS
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The container config endpoint is described as returning the full configuration including environment variables, volumes, and ports, but the documentation does not warn that environment values commonly contain secrets such as API keys, database passwords, or tokens. In an agent setting, exposing and potentially echoing these values can lead to credential disclosure across conversations, logs, downstream tools, or prompt-injected exfiltration paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The API documents state-changing container lifecycle operations (start, stop, restart) without requiring or even recommending an explicit user confirmation step. In an agent context, this increases the chance that an LLM could disrupt running services, cause downtime, or restart sensitive workloads based on ambiguous prompts or prompt injection, especially since this skill is specifically designed for remote Docker management.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The marketplace start flow invokes
docker compose up -d, which can pull images and launch one or more containers, but the documentation lacks a user-facing warning about the effects of starting software from a compose file. In this agent-operated homelab context, that omission is risky because it may lead to unreviewed code execution, unintended network exposure, resource consumption, or deployment of third-party images without informed user approval.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Ubuntu/Debian instructions begin by removing existing Docker-related packages without a nearby warning about what may be uninstalled or disrupted. In an agent skill context, users may follow commands verbatim, so omitting an explicit warning increases the risk of unintended service interruption or package removal on systems already using container tooling.
- Content
Static analysis
No suspicious patterns detected.