AppInspector logoAppInspector
Automated Analysis != Safety. This is a Developer Transparency Tool.
Inspector

Cloudron community app transparency reports

Inspect a Cloudron community app `CloudronVersions.json` feed. Repository analysis is derived from the package metadata in that feed, and the report stays intentionally conservative: it surfaces what the package appears to do, but it does not certify safety.

What this checks
CHECKS EXPLAINED
Checks Explained
Metadata links and missing fields
Reads the Cloudron feed metadata, checks whether important links are valid, and notes when required fields are missing.
Dockerfile command patterns
Scans Docker build steps for risky commands such as destructive deletes, world-writable permissions, or remote scripts piped into a shell.
Runtime shell network calls
Looks through startup shell scripts for commands like curl, wget, nc, or ssh that may contact remote systems during runtime.
Privilege escalation and credential leakage
Flags startup-script patterns that touch privileged system paths, invoke sudo, or combine secrets with outbound commands.
Feed vs repo version drift
Compares the version published in CloudronVersions.json with the version found in the package repository when that repository can be identified reliably.
  • Metadata links and missing fields
  • Dockerfile command patterns
  • Runtime shell network calls
  • Privilege escalation and credential leakage
  • Feed vs repo version drift
Refresh
Example inputs
https://communityapps.appx.uk/cloudron-notediscovery/CloudronVersions.json
https://raw.githubusercontent.com/BrutalBirdie/cloudron-tachyon-app/refs/heads/master/CloudronVersions.json
https://communityapps.appx.uk/cloudron-ocular/CloudronVersions.json
Generated Report

PILOS

PILOS

Score
53/100
53 reached47 still requires deeper inspection
Automated checks can score at most 70/100. The remaining 30 points require deep inspection.
This tool is for informational purposes only. Use at your own risk.
Safety Flags
2
Fail
1
Unsure
7
Pass
Master Info
Install feed
https://git.cloudron.io/elias/pilos/-/raw/master/CloudronVersions.json
packageUrl
Not available
Website link
https://github.com/THM-Health/PILOS
Repository
Not available
Packager
BrutalBirdie
packagerUrl
https://git.cloudron.io/BrutalBirdie/pilos
minBox
9.1.0
Version
1.0.7
Tags
conferencemeetingbigbluebuttonvideocall
Detailed Checklist
packageUrl link is present and well formed when required (7/7)
pass
No `packageUrl` declared. This is valid for packages targeting minBoxVersion below 10.
Website link is present and well formed (7/7)
pass
https://github.com/THM-Health/PILOS
Metadata and README links avoid insecure HTTP (7/7)
pass
No HTTP links found.
Metadata and README links avoid URL shorteners (7/7)
pass
No shortener links found.
Cloudron feed version matches the repository manifest (0/7)
fail
Feed reports 1.0.7; repo manifest reports 1.0.4.
Repository content was fetched for static analysis (7/7)
pass
https://git.cloudron.io/BrutalBirdie/pilos @ 0a3e7e806656225a3f191ef887d5c14ef39ab799
Dockerfile scan did not detect clearly suspicious commands (4/7)
unsure
Dockerfile:11 System package installation found. Review whether all packages are justified. Dockerfile:12 System package installation found. Review whether all packages are justified.
Runtime shell scripts avoid suspicious outbound network calls (7/7)
pass
No runtime network commands found in scanned shell scripts.
Runtime shell scripts avoid privilege escalation patterns (0/7)
fail
Docker/app/code/start.sh:24 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:25 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:28 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:97 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:98 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:99 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:100 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:101 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:102 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:103 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:104 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:105 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:122 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:143 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:149 Privileged command or direct system-path modification detected in startup script. Docker/app/code/start.sh:151 Privileged command or direct system-path modification detected in startup script.
Runtime shell scripts avoid credential leakage patterns (7/7)
pass
No credential leakage patterns found in scanned shell scripts.
Raw Findings
Flagged lines are highlighted directly in the code snippet.
18 findings
Dockerfile:11
low
System package installation found. Review whether all packages are justified.
9RUN add-apt-repository --yes ppa:ondrej/php && \
10    apt update && \
11    apt install -y php8.4 php8.4-{apcu,bcmath,bz2,cgi,cli,common,curl,dba,dev,enchant,fpm,gd,gmp,gnupg,imagick,imap,interbase,intl,ldap,mailparse,mbstring,mysql,odbc,opcache,pgsql,phpdbg,pspell,readline,redis,snmp,soap,sqlite3,sybase,tidy,uuid,xml,xmlrpc,xsl,zip,zmq} libapache2-mod-php8.4 && \
12    apt install -y php-{date,pear,twig,validate} && \
13    rm -rf /var/cache/apt /var/lib/apt/lists
Dockerfile:12
low
System package installation found. Review whether all packages are justified.
10    apt update && \
11    apt install -y php8.4 php8.4-{apcu,bcmath,bz2,cgi,cli,common,curl,dba,dev,enchant,fpm,gd,gmp,gnupg,imagick,imap,interbase,intl,ldap,mailparse,mbstring,mysql,odbc,opcache,pgsql,phpdbg,pspell,readline,redis,snmp,soap,sqlite3,sybase,tidy,uuid,xml,xmlrpc,xsl,zip,zmq} libapache2-mod-php8.4 && \
12    apt install -y php-{date,pear,twig,validate} && \
13    rm -rf /var/cache/apt /var/lib/apt/lists
14
Docker/app/code/start.sh:24
high
Privileged command or direct system-path modification detected in startup script.
22    echo '=> theme folder missing creating and adding defaults'
23    mkdir theme
24    rsync -arlP /var/www/html/resources/sass/theme/default/ theme/
25    rsync -arlP theme/ /var/www/html/resources/sass/theme/custom/
26else
Docker/app/code/start.sh:25
high
Privileged command or direct system-path modification detected in startup script.
23    mkdir theme
24    rsync -arlP /var/www/html/resources/sass/theme/default/ theme/
25    rsync -arlP theme/ /var/www/html/resources/sass/theme/custom/
26else
27    echo '=> Folder exists. Syncing theme to custom'
Docker/app/code/start.sh:28
high
Privileged command or direct system-path modification detected in startup script.
26else
27    echo '=> Folder exists. Syncing theme to custom'
28    rsync -arlP theme/ /var/www/html/resources/sass/theme/custom/
29fi
30
Docker/app/code/start.sh:97
high
Privileged command or direct system-path modification detected in startup script.
95function changePermissions() {
96    echo "Changing permissions"
97    chown -R www-data:www-data /var/www/html/storage/
98    chown -R :www-data /var/www/html/resources/custom
99    chown -R :www-data /var/www/html/resources/sass/theme/custom
Docker/app/code/start.sh:98
high
Privileged command or direct system-path modification detected in startup script.
96    echo "Changing permissions"
97    chown -R www-data:www-data /var/www/html/storage/
98    chown -R :www-data /var/www/html/resources/custom
99    chown -R :www-data /var/www/html/resources/sass/theme/custom
100    find /var/www/html/storage/ -type f -exec chmod 664 {} \;
Docker/app/code/start.sh:99
high
Privileged command or direct system-path modification detected in startup script.
97    chown -R www-data:www-data /var/www/html/storage/
98    chown -R :www-data /var/www/html/resources/custom
99    chown -R :www-data /var/www/html/resources/sass/theme/custom
100    find /var/www/html/storage/ -type f -exec chmod 664 {} \;
101    find /var/www/html/storage/ -type d -exec chmod 775 {} \;
Docker/app/code/start.sh:100
high
Privileged command or direct system-path modification detected in startup script.
98    chown -R :www-data /var/www/html/resources/custom
99    chown -R :www-data /var/www/html/resources/sass/theme/custom
100    find /var/www/html/storage/ -type f -exec chmod 664 {} \;
101    find /var/www/html/storage/ -type d -exec chmod 775 {} \;
102    find /var/www/html/resources/custom/ -type f -exec chmod 664 {} \;
Docker/app/code/start.sh:101
high
Privileged command or direct system-path modification detected in startup script.
99    chown -R :www-data /var/www/html/resources/sass/theme/custom
100    find /var/www/html/storage/ -type f -exec chmod 664 {} \;
101    find /var/www/html/storage/ -type d -exec chmod 775 {} \;
102    find /var/www/html/resources/custom/ -type f -exec chmod 664 {} \;
103    find /var/www/html/resources/custom/ -type d -exec chmod 775 {} \;
Docker/app/code/start.sh:102
high
Privileged command or direct system-path modification detected in startup script.
100    find /var/www/html/storage/ -type f -exec chmod 664 {} \;
101    find /var/www/html/storage/ -type d -exec chmod 775 {} \;
102    find /var/www/html/resources/custom/ -type f -exec chmod 664 {} \;
103    find /var/www/html/resources/custom/ -type d -exec chmod 775 {} \;
104    find /var/www/html/resources/sass/theme/custom/ -type f -exec chmod 664 {} \;
Docker/app/code/start.sh:103
high
Privileged command or direct system-path modification detected in startup script.
101    find /var/www/html/storage/ -type d -exec chmod 775 {} \;
102    find /var/www/html/resources/custom/ -type f -exec chmod 664 {} \;
103    find /var/www/html/resources/custom/ -type d -exec chmod 775 {} \;
104    find /var/www/html/resources/sass/theme/custom/ -type f -exec chmod 664 {} \;
105    find /var/www/html/resources/sass/theme/custom/ -type d -exec chmod 775 {} \;
Docker/app/code/start.sh:104
high
Privileged command or direct system-path modification detected in startup script.
102    find /var/www/html/resources/custom/ -type f -exec chmod 664 {} \;
103    find /var/www/html/resources/custom/ -type d -exec chmod 775 {} \;
104    find /var/www/html/resources/sass/theme/custom/ -type f -exec chmod 664 {} \;
105    find /var/www/html/resources/sass/theme/custom/ -type d -exec chmod 775 {} \;
106}
Docker/app/code/start.sh:105
high
Privileged command or direct system-path modification detected in startup script.
103    find /var/www/html/resources/custom/ -type d -exec chmod 775 {} \;
104    find /var/www/html/resources/sass/theme/custom/ -type f -exec chmod 664 {} \;
105    find /var/www/html/resources/sass/theme/custom/ -type d -exec chmod 775 {} \;
106}
107
Docker/app/code/start.sh:122
high
Privileged command or direct system-path modification detected in startup script.
120function buildFrontend() {
121    echo "Building frontend"
122	/usr/local/etc/frontend/run.sh
123}
124
Docker/app/code/start.sh:143
high
Privileged command or direct system-path modification detected in startup script.
141echo "=> Ensure runtime dirs exist"
142mkdir -p /run/php/ \
143    /var/log/nginx/ \
144    /run/nginx/scgi \
145    /run/nginx/uwsgi \
Docker/app/code/start.sh:149
high
Privileged command or direct system-path modification detected in startup script.
147    /run/nginx/fastcgi \
148    /run/nginx/proxy \
149    /var/log/supervisor
150 
151exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
Docker/app/code/start.sh:151
high
Privileged command or direct system-path modification detected in startup script.
149    /var/log/supervisor
150 
151exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
152
0.0.9