sc-dokploy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sc-dokploy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user wants to inspect, change, or clean up Dokploy state directly (without redeploying code).
DOKPLOY_API_URL, DOKPLOY_API_KEY — Dokploy adminssh -i ~/.ssh/id_n8n rahman@srv614914 with passwordless sudo.If missing, route to /sc-onboarding.
Dokploy REST API covers projects, applications, compose, domains, deploy/start/stop, monitoring read. It does NOT cover:
docker service rm (orphan swarm services)rm /etc/dokploy/traefik/dynamic/<file>.yml (orphan Traefik routers)For those, SSH in directly. Useful one-liners:
ssh -i ~/.ssh/id_n8n rahman@srv614914 'sudo -n docker service ls'
ssh -i ~/.ssh/id_n8n rahman@srv614914 'sudo -n ls /etc/dokploy/traefik/dynamic/'
ssh -i ~/.ssh/id_n8n rahman@srv614914 'sudo -n docker service rm <name>'
ssh -i ~/.ssh/id_n8n rahman@srv614914 'sudo -n rm /etc/dokploy/traefik/dynamic/<name>.yml' # Traefik file watcher reloads in ~5-10sOrphan-service pattern: when a Dokploy app is recreated, the old swarm service and its Traefik dynamic config can survive deletion. Both compete for the same Host(...) rule. Symptom: prod serves an old image even after a fresh deploy. Diagnosis: docker service ls shows two services for the same project, and two .yml files in traefik/dynamic/ bind the same domain. Fix: remove the orphan file + service.
domain.create may 4xx on duplicate; treat that as a no-op, not an error.audit.js's selectDomainsToDelete — keep the desired canonical host, drop *.traefik.me and duplicates.DOKPLOY_API_URL is the control plane. Never rewrite it inside scripts — read it from env.x-api-key, NOT Authorization: Bearer.projects.js — Project CRUDnode scripts/projects.js list
node scripts/projects.js create <name>
node scripts/projects.js show <name>apps.js — Application CRUDnode scripts/apps.js list --project <name>
node scripts/apps.js show --project <name> --app <name>
node scripts/apps.js deploy --project <name> --app <name>compose.js — Compose service CRUDnode scripts/compose.js list --project <name>
node scripts/compose.js show --compose <composeName>
node scripts/compose.js env --compose <composeName>
node scripts/compose.js deploy --compose <composeName>domains.js — Domain CRUDnode scripts/domains.js list-app --app-id <id>
node scripts/domains.js list-compose --compose-id <id>
node scripts/domains.js create-app --app-id <id> --host <host> [--port N] [--service NAME]
node scripts/domains.js delete --domain-id <id>audit.js — SweepReports across all projects:
*.traefik.me placeholder hosts that should be removednode scripts/audit.js [--fix] # --fix removes stale domainsdebug.js — Status & recent deploymentsnode scripts/debug.js status --project <name> --app <name>
node scripts/debug.js status --compose <composeName>
node scripts/debug.js deployments --app-id <id>| Action | Endpoint | Method |
|---|---|---|
| List projects | /project.all | GET |
| Create project | /project.create | POST { name } |
| Get application | /application.one?applicationId= | GET |
| Update application | /application.update | POST |
| Deploy application | /application.deploy | POST { applicationId } |
| Get compose | /compose.one?composeId= | GET |
| Update compose | /compose.update | POST |
| Deploy compose | /compose.deploy | POST { composeId } |
| Deploy compose template | /compose.deployTemplate | POST { environmentId, id } |
| Create domain | /domain.create | POST |
| Delete domain | /domain.delete | POST { domainId } |
| List GitHub providers | /github.githubProviders | GET |
| Save app GH provider | /application.saveGithubProvider | POST |
Auth: x-api-key: <DOKPLOY_API_KEY>.
Dokploy build logs are NOT exposed over the REST API (as of this skill's last update). On deployment failure, point the user at the Dokploy dashboard: <DOKPLOY_API_URL without /api> → project → service → Deployments
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.