api.insecure: true puts the Traefik dashboard and API on port 8080 with no login, and a router to api@internal with only a headers middleware does the same on your public host name. This skill finds those and nine other Traefik mistakes before you expose the proxy, and tells you how to fix each one.

Your agent runs a scanner on your project: traefik.yml and traefik.toml static files, dynamic YAML and TOML files for the file provider, Docker Compose and Swarm files (the traefik.* labels and the Traefik service's command-line flags, TRAEFIK_* variables and volumes), Kubernetes manifests (IngressRoute, Middleware, TLSOption and ServersTransport resources, and containers that run Traefik) and Traefik Helm chart values. It parses YAML and TOML with line numbers, reads keys without regard to case as Traefik does, follows middleware chains, and treats {{ env }} and ${VAR} values as references, not secrets. It never runs Traefik, Docker or kubectl. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• T01: api.insecure (in a file, a --api.insecure flag or TRAEFIK_API_INSECURE) and providers.rest.insecure

• T02: routers to api@internal (and Helm chart dashboards on a public entrypoint) with no basicAuth, digestAuth, forwardAuth or ipAllowList middleware and no ClientIP() in the rule

• T03: insecureSkipVerify: true on servers transports, providers, forwardAuth and exporters

• T04: tokens, passwords, Authorization headers, user:password@ URLs and inline private keys in the configuration, and DNS provider keys such as CF_DNS_API_TOKEN written in the Traefik container's environment

REVIEW (check before release)

• T11: the Docker or Swarm provider without exposedByDefault: false

• T12: a port 80 entrypoint with no HTTPS redirect while HTTPS is set up

• T13: the Docker or Podman socket mounted into the Traefik container (also with :ro, which does not limit API calls). Expect T13 on most Docker-provider setups unless a socket proxy is used.

• T14: TLS options that allow TLS 1.0 or 1.1, or RC4, 3DES or NULL cipher suites

• T15: DEBUG or TRACE logging and api.debug

• T16: access logs that keep Authorization or Cookie headers

• T17: forwarded headers or PROXY protocol trusted from every client

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (Compose file, static and dynamic configuration), and the real report the scanner produces on the risky one

Limits

It reads each file as written. Settings that Traefik merges at run time from other places are not followed: middlewares defined in another provider, .env values, Helm templates and --set values, Consul, etcd or Redis key-value stores, and Traefik v1 files. Other Compose services are left to a Compose checker. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 14 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (6 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.