Inspector

Cloudron community app transparency reports

Inspect a Cloudron community app `CloudronVersions.json` feed. Repository analysis is derived from the package metadata in that feed, and the report stays intentionally conservative: it surfaces what the package appears to do, but it does not certify safety.

What this checks

CHECKS EXPLAINED

Checks Explained

Metadata links and missing fields

Reads the Cloudron feed metadata, checks whether important links are valid, and notes when required fields are missing.

Dockerfile command patterns

Scans Docker build steps for risky commands such as destructive deletes, world-writable permissions, or remote scripts piped into a shell.

Runtime shell network calls

Looks through startup shell scripts for commands like curl, wget, nc, or ssh that may contact remote systems during runtime.

Privilege escalation and credential leakage

Flags startup-script patterns that touch privileged system paths, invoke sudo, or combine secrets with outbound commands.

Feed vs repo version drift

Compares the version published in CloudronVersions.json with the version found in the package repository when that repository can be identified reliably.

Metadata links and missing fields
Dockerfile command patterns
Runtime shell network calls
Privilege escalation and credential leakage
Feed vs repo version drift

Example inputs

https://communityapps.appx.uk/cloudron-notediscovery/CloudronVersions.json

https://raw.githubusercontent.com/BrutalBirdie/cloudron-tachyon-app/refs/heads/master/CloudronVersions.json

https://communityapps.appx.uk/cloudron-ocular/CloudronVersions.json

Generated Report

Semaphore UI

Web interface for running Ansible playbooks, inventories and schedules

Score

60/100

60 reached40 still requires deeper inspection

Automated checks can score at most 70/100. The remaining 30 points require deep inspection.

This tool is for informational purposes only. Use at your own risk.

Safety Flags

Fail

Unsure

Pass

Master Info

Install feed

https://raw.githubusercontent.com/OrcVole/semaphore-cloudron/main/CloudronVersions.json

packageUrl

Not available

Website link

https://semaphoreui.com

Repository

Not available

Packager

OrcVole

packagerUrl

https://github.com/OrcVole/semaphore-cloudron

minBox

9.1.0

Version

1.0.10

Tags

ansibleautomationdevopsplaybooksinfrastructure

Detailed Checklist

packageUrl link is present and well formed when required (7/7)

pass

No `packageUrl` declared. This is valid for packages targeting minBoxVersion below 10.

Website link is present and well formed (7/7)

pass

https://semaphoreui.com

Metadata and README links avoid insecure HTTP (7/7)

pass

No HTTP links found.

Metadata and README links avoid URL shorteners (7/7)

pass

No shortener links found.

Cloudron feed version matches the repository manifest (7/7)

pass

Feed and repo both report 1.0.10.

Repository content was fetched for static analysis (7/7)

pass

https://github.com/OrcVole/semaphore-cloudron @ d0a932cff5146e3fb5eb8a22b26372bc9dfbdece

Dockerfile scan did not detect clearly suspicious commands (0/7)

fail

Dockerfile:9 System package installation found. Review whether all packages are justified. Dockerfile:10 Remote script piped directly into a shell in Dockerfile. Dockerfile:11 System package installation found. Review whether all packages are justified. Dockerfile:29 System package installation found. Review whether all packages are justified.

Runtime shell scripts avoid suspicious outbound network calls (4/7)

unsure

start.sh:37 Network-capable command found in a runtime shell script. start.sh:38 Network-capable command found in a runtime shell script. start.sh:39 Network-capable command found in a runtime shell script.

Runtime shell scripts avoid privilege escalation patterns (7/7)

pass

No privilege-escalation patterns found in scanned shell scripts.

Runtime shell scripts avoid credential leakage patterns (7/7)

pass

No credential leakage patterns found in scanned shell scripts.

Raw Findings

Flagged lines are highlighted directly in the code snippet.

7 findings

Dockerfile:9

low

System package installation found. Review whether all packages are justified.

7ARG SEMAPHORE_VERSION
8 
9RUN apt-get update && apt-get install -y --no-install-recommends git curl && \
10    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
11    apt-get install -y --no-install-recommends nodejs && \

Dockerfile:10

high

Remote script piped directly into a shell in Dockerfile.

8 
9RUN apt-get update && apt-get install -y --no-install-recommends git curl && \
10    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
11    apt-get install -y --no-install-recommends nodejs && \
12    rm -rf /var/lib/apt/lists/*

Dockerfile:11

low

System package installation found. Review whether all packages are justified.

9RUN apt-get update && apt-get install -y --no-install-recommends git curl && \
10    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
11    apt-get install -y --no-install-recommends nodejs && \
12    rm -rf /var/lib/apt/lists/*
13

Dockerfile:29

low

System package installation found. Review whether all packages are justified.

27FROM cloudron/base:5.0.0
28 
29RUN apt-get update && apt-get install -y --no-install-recommends ansible git && \
30    rm -rf /var/lib/apt/lists/*
31

start.sh:37

medium

Network-capable command found in a runtime shell script.

35# world-readable directory, so create it with the right mode rather than letting the first
36# connection fail on a permissions check.
37mkdir -p /app/data/home/.ssh
38chown cloudron:cloudron /app/data/home/.ssh
39chmod 700 /app/data/home/.ssh

start.sh:38

medium

Network-capable command found in a runtime shell script.

36# connection fail on a permissions check.
37mkdir -p /app/data/home/.ssh
38chown cloudron:cloudron /app/data/home/.ssh
39chmod 700 /app/data/home/.ssh
40

start.sh:39

medium

Network-capable command found in a runtime shell script.

37mkdir -p /app/data/home/.ssh
38chown cloudron:cloudron /app/data/home/.ssh
39chmod 700 /app/data/home/.ssh
40 
41export SEMAPHORE_DB_DIALECT=postgres