Homelab Cluster Management

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:00 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent homelab operations guide, but it needs review because it encourages automatic remote recovery and mutable Docker usage without enough guardrails.

Review this skill before installing. Only use it on homelab hosts you control, require explicit approval before SSH/RDP recovery or Docker restarts, pin Docker images by digest, mount source model paths read-only and narrowly, and keep recovery credentials in a vault as the skill recommends.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:91

Finding

Unpinned Container Image Executed with Writable Host Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:91
Vulnerability Type: Supply-chain risk from a mutable container image with writable mounts
Risk Level: Medium

bash

docker run --rm -v models-vol:/models -v /host/path:/src alpine cp /src/model.gguf /models/

Technical Analysis

The documented command executes the mutable, registry-unqualified alpine image without pinning it to a verified digest. Consequently, the code executed depends on whichever local or remote image the alpine tag resolves to at runtime rather than the artifact reviewed when this skill was audited.

The container is also granted writable access to both /host/path and the persistent models-vol volume because neither mount is marked read-only. A malicious or compromised image could therefore read, alter, or delete accessible files in the mounted host directory and could replace the model stored in the persistent volume.

This creates a supply-chain boundary in which registry compromise, mutable-tag replacement, or local image-name spoofing could convert a documented file-copy operation into attacker-controlled container execution.

Attack Path

1. An attacker causes the alpine tag to resolve to a malicious image, such as through registry compromise, tag replacement, or placement of a spoofed local image.
2. An operator follows the documented command without verifying the image digest or provenance.
3. Docker starts the attacker-controlled image and mounts /host/path and models-vol with write access.
4. The malicious image reads or modifies files under the mounted host path.
5. It replaces or corrupts model.gguf or other content in the persistent model volume.
6. A subsequent inference container loads the altered model or related artifacts, causing service disruption or use of attacker-modified data.

Impact Assessment

The attacker obtains the privileges available to the container over the two mounted resour ...[truncated 575 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a fully qualified image reference pinned to a vendor-verified immutable digest:

   bash

   docker run --rm \
     --network none \
     --cap-drop ALL \
     --security-opt no-new-privileges \
     -v models-vol:/models \
     -v /host/path:/src:ro \
     docker.io/library/alpine@sha256:VERIFIED_DIGEST \
     cp /src/model.gguf /models/
   

2. Verify the image digest and provenance through a trusted registry or signed-image policy before documenting or executing it.
3. Mark the source host mount read-only with :ro.
4. Mount only the narrowest required source directory and ensure it contains no credentials or unrelated sensitive files.
5. Disable networking and remove Linux capabilities because the copy operation does not require them.
6. Verify the copied model against an expected cryptographic checksum before deploying it to an inference service.
7. Where practical, replace the helper container with a trusted host-side or Docker volume-management workflow that does not execute a third-party image with host mounts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The automatic recovery workflow recommends restarting Docker via SSH and initiating an RDP session to wake a machine, both of which are system-impacting remote actions. In an agent skill context, this is dangerous because it normalizes potentially disruptive control operations without explicit confirmation gates, scope limits, or warnings, increasing the risk of unintended service interruption or unauthorized remote administration.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

docker volume create models-vol

# Copy models INTO the volume
docker run --rm -v models-vol:/models -v /host/path:/src alpine cp /src/model.gguf /models/

# Run container FROM volume (not bind mount)
docker run -d --gpus all -v models-vol:/models -p 3009:8000 \

Static analysis

No suspicious patterns detected.