Soc Deploy Misp
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill coherently deploys MISP on a Docker host, but users should notice that it runs remote deployment commands, pulls an unpinned upstream project, and stores powerful credentials in a plaintext file.
This appears to be a straightforward MISP deployment helper. Before installing, make sure the SSH target is the right host, use a strong custom admin password, protect or delete the generated ~/misp/api-key.txt file, and consider pinning the upstream misp-docker version for production use.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the skill will make real changes on the selected machine, including starting Docker services and writing configuration files.
The skill directs the agent/user to copy and run a shell deployment script on a remote host. This is expected for deploying MISP, but it gives the script authority to modify that host.
scp scripts/setup.sh <target>:~/ ssh <target> "bash ~/setup.sh 'admin@misp.local' '<password>'"
Run it only on a host intended for MISP, review the target before execution, and keep backups or a rollback plan for that host.
What gets deployed can change if the upstream repository changes, even though using the official MISP Docker project is consistent with the skill’s purpose.
The script pulls the live upstream MISP Docker repository and runs its Compose deployment without pinning a commit or release.
git clone --quiet https://github.com/MISP/misp-docker.git "$MISP_DIR" ... docker compose up -d
For production or repeatable deployments, pin the MISP Docker repository to a reviewed tag or commit and review Compose changes before running.
Anyone who can read the credential file or knows the unchanged default password could gain significant access to the MISP instance.
The script supports a static default admin password and saves the MISP admin password, API key, and database passwords in a plaintext file.
PASSWORD="${2:-ChangeMe123!}"
...
cat > ~/misp/api-key.txt << EOF
...
Admin: ${ADMIN_EMAIL} / ${PASSWORD}
API Key: ${API_KEY}
...
MySQL Root: ${MYSQL_ROOT_PW}Always provide a strong unique admin password, restrict permissions on ~/misp/api-key.txt, and rotate or remove stored credentials after setup if they are not needed.