T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:198- Finding
Writable Host Docker Socket Exposes the Kubernetes Node to Privilege Escalation
- Content
View full analysis
- Remediation
View remediation
Security audit
test
Security checks for vulnerabilities and agentic risk
Overview
This skill is for CI/CD automation, but its required Jenkins template gives build jobs high-impact host Docker access and has ambiguous credential handling, so users should review it carefully before installing.
Install only if you are comfortable with the generated Jenkins jobs having powerful access to the CI worker environment. Prefer a revised version that removes the host Docker socket mount, uses an isolated image builder, accepts only credential IDs rather than raw passwords, and validates or safely renders all Jenkinsfile inputs before pipeline creation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:225- Finding
Direct Jenkinsfile Substitution Permits Groovy and Shell Injection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:61- Finding
Ambiguous Git Password Handling Can Store Credentials in Plaintext
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Docker Socket Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
Mounting /var/run/docker.sock into the build container gives the pipeline direct control over the host Docker daemon. Any code executed during clone/build can abuse that socket to start privileged containers, access the host filesystem, escape isolation, or steal secrets from the node, making this especially dangerous in a CI pipeline that builds untrusted or changing source code.
- Content
md cpu: "4000m" memory: "8192Mi" volumeMounts: - mountPath: "/var/run/docker.sock" name: "volume-1" readOnly: false - mountPath: /root/.m2/settings.xml
Privileged Kubernetes Workload
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
Use of hostPath in a Kubernetes agent pod is a privileged workload pattern because it pierces normal pod isolation and exposes host resources directly to the container. Here the mounted resource is the Docker socket, which substantially increases the risk by enabling host-level actions from CI job code and making the skill more dangerous than a typical deployment template.
- Content
md subPath: settings.xml volumes: - name: "volume-1" hostPath: path: "/var/run/docker.sock" - name: config configMap:
Docker Socket Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The hostPath volume exposing /var/run/docker.sock is the underlying mechanism that grants host-level Docker control to the pod. In this skill, the socket is embedded in a reusable Jenkins pipeline skeleton, so any generated pipeline inherits a dangerous privilege boundary bypass by default.
- Content
md volumes: - name: "volume-1" hostPath: path: "/var/run/docker.sock" - name: config configMap: name: jenkins-agent-config
Docker Socket Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This example pipeline repeats the Docker socket mount, normalizing an unsafe pattern as a recommended implementation. Because the skill automates CI/CD for deployed workloads, compromise of the build step can cascade into malicious image publication and automated rollout to running applications.
- Content
md cpu: "4000m" memory: "8192Mi" volumeMounts: - mountPath: "/var/run/docker.sock" name: "volume-1" readOnly: false - mountPath: /root/.m2/settings.xml
Privileged Kubernetes Workload
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The sample configuration includes a hostPath mount, which is a privileged Kubernetes pattern and weakens node/pod isolation. In the CI/CD context, this is particularly risky because attacker-controlled repository contents or build commands can leverage that access to compromise the node and downstream deployment pipeline.
- Content
md name: config subPath: settings.xml volumes: - hostPath: path: "/var/run/docker.sock" name: "volume-1" - configMap:
Docker Socket Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The example's hostPath declaration again exposes /var/run/docker.sock from the node into the pod, enabling container breakout and host manipulation through the Docker API. Including it in sample code increases the likelihood that users deploy the unsafe configuration unchanged.
- Content
md subPath: settings.xml volumes: - hostPath: path: "/var/run/docker.sock" name: "volume-1" - configMap: items:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description is written as a mandatory Chinese-only instruction set and the file provides no option for users to choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.