Publishing port 11434:11434 on the official Ollama image puts an API with no password on every network interface of your GPU server, and WEBUI_AUTH=False on a published Open WebUI makes every visitor an administrator who can run Python on the server. This skill finds those and nine other self-hosted LLM mistakes before you expose the server, and tells you how to fix each one.

Your agent runs a scanner on your Compose files, Kubernetes manifests, Dockerfiles, systemd units and drop-ins, .env files and LiteLLM proxy configs. It recognises each server by its image or command and knows its defaults: the official Ollama and llama.cpp images listen on all interfaces, ollama serve and llama-server on a bare host listen on 127.0.0.1, and vLLM, LocalAI, TGI and the LiteLLM proxy listen on all interfaces unless told otherwise. A port published on 127.0.0.1, a bind to one LAN or VPN address and an internal cloud load balancer are not reported; settings a container takes from a ConfigMap in the same manifest count as its own; ${VAR}, secretKeyRef and LiteLLM environment references count as references, and dummy keys such as fake-key or EMPTY for a backend that needs none are not secrets. Each open-port finding names that server's own port, bind setting and key setting. It never starts a server, a container or a model. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• L01: an Ollama, vLLM, llama.cpp server, LocalAI, TGI or LiteLLM proxy reachable from the network (published port, host network, LoadBalancer or NodePort Service, 0.0.0.0 bind) with no API key
• L02: API keys (including key lists such as OPENAI_API_KEYS), master keys, tokens and passwords written in Compose, Kubernetes, Dockerfile, systemd or LiteLLM config files or on the command line
• L03: Open WebUI with WEBUI_AUTH turned off and reachable from the network
• L04: Open WebUI DEFAULT_USER_ROLE=admin while sign-up, OAuth sign-up, LDAP or header login can create accounts

REVIEW (check before release)

• L11: --trust-remote-code without a revision pinned to a commit
• L12: * in OLLAMA_ORIGINS, vLLM --allowed-origins and other CORS settings, and vLLM releases before 0.32.0 whose default allowed any origin
• L13: Open WebUI sign-up without approval (role user), or admin as the default role
• L14: model server images with no version in the tag (latest, main, server-cuda)
• L15: API or UI ports published over plain HTTP, including vLLM paths its --api-key does not cover
• L16: vLLM dev mode, insecure serialization or wide local media access, and llama-server --props
• L17: keys and passwords set to sample or default values from the docs, or a dummy value used as a server's own key

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official documentation link for each rule
• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It reads each file on its own: a Service, ConfigMap or .env file kept in another file is not joined to its server, and docker run commands in scripts are not read. Firewalls, cloud security groups and reverse proxies configured elsewhere are not seen, and Open WebUI settings changed in its admin panel are not checked. SGLang, TabbyAPI and LM Studio are not covered. The Ollama and llama.cpp quick-start port mappings are reported on purpose, because they publish an API without a key on every interface. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 20 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (12 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.