Traefik Mantrae Diagnostics

• Outcome: Review
• Latest audit: May 28, 2026 · 10:03 AM UTC
• Version: 0.1.0

Overview

This looks like a real diagnostics skill, but it gives broad authenticated Mantrae management API reach without enforcing the read-only boundary it advertises.

Install only in a trusted operations environment. Use a least-privilege read-only Mantrae token, avoid admin passwords, do not use arbitrary RPC paths or custom write-like messages, and avoid --insecure or curl -k except for an explicitly approved break-glass diagnostic.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises read-only Traefik diagnostics, but it relies on undeclared environment-variable and network capabilities to reach internal services and consume credentials. Hidden capability scope increases the chance that an agent or reviewer will underestimate what the skill can access, especially in environments where permissions are expected to be explicitly declared and constrained.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a genuine scope-expansion issue: the skill claims Traefik read-only troubleshooting, but the documented behavior includes authenticating to a separate Mantrae management API, accessing broader management data, and supporting arbitrary RPC paths and custom request bodies. That mismatch can cause operators to approve or invoke a skill with far greater access than intended, enabling unintended data exposure or administrative actions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The document repeatedly frames the skill as read-only, yet it also states that Mantrae can be used for controlled configuration changes and warns against calling create/update/delete/restore endpoints. That means write-capable management access exists within the skill context, so the read-only claim is materially misleading and could lead to accidental or unauthorized modification of reverse-proxy configuration.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Embedding credentialed access to a separate Mantrae management API broadens the trust boundary well beyond Traefik diagnostics. Even if intended for inspection, this exposes additional systems, tokens, and potentially sensitive operational metadata that are not obvious from the skill name and summary.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script’s advertised purpose is read-only Traefik inspection, but it includes a generic authenticated login flow and RPC method map that reaches broader Mantrae administrative surfaces. This expands the accessible data and capability scope beyond the stated skill intent, increasing the risk of over-privileged use, accidental data exposure, and misuse in environments where the skill is assumed to be narrowly scoped.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The method list exposes backups, audit logs, settings, agents, and DNS provider data, which are not clearly necessary for a Traefik troubleshooting skill. Even if requests are read-only, these endpoints can reveal sensitive operational, infrastructure, and security information that broadens the blast radius of the skill.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The default base URL uses plain HTTP, so login credentials, bearer tokens, and returned API data may be sent unencrypted over the network. In any non-local or misconfigured environment, this enables interception or modification by an attacker on the network path.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The --insecure option disables TLS certificate validation by using an unverified SSL context, making the connection vulnerable to man-in-the-middle attacks. Because the script handles passwords and bearer tokens, disabling verification materially weakens transport security and can expose both credentials and sensitive API responses.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

If DNS does not resolve from the OpenClaw host, test through Traefik IP with curl:

```bash
curl -k --resolve mantrae.example.internal:443:10.0.0.10 https://mantrae.example.internal/openapi.json
```

Do not call create/update/delete/restore endpoints without a fresh backup and Igor's confirmation.

• Confidence: 88% confidence
• Finding: The documented use of `curl -k` disables TLS certificate verification, which trains operators or agents to bypass transport security when connecting to an authenticated internal API. In combination with `--resolve` and bearer-token or credential usage, this creates a realistic man-in-the-middle risk and can expose sensitive API schemas, tokens, or responses on hostile networks.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/mantrae_api.py:68