Doro Docker Essentials

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is an instruction-only Docker command reference; it documents powerful Docker operations but does not include code or hidden automatic behavior.

This skill is reasonable to install as a Docker command reference. Before letting an agent act on it, make sure Docker commands that remove, prune, push, mount host paths, or open root shells are explicitly approved and targeted at the correct containers, images, volumes, and registries.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If run without care, these commands could stop services or delete container/image/volume data.

Why it was flagged

These are destructive Docker operations that can remove running containers or unused Docker resources, including volumes. They are purpose-aligned reference commands, but they have real local impact if executed.

Skill content

docker rm -f container_name
...
docker container prune
...
docker system prune --volumes

Recommendation

Require explicit confirmation before running stop, remove, prune, down -v, push, or other mutating Docker commands, and verify targets before execution.

Medium

#ASI03: Identity and Privilege Abuse

What this means

A careless command could give a container access to unintended local files or modify a container as root.

Why it was flagged

The skill documents root execution inside containers and host path mounts. These are normal Docker debugging features, but they can expose host files or alter containers with elevated privileges.

Skill content

docker exec -u root -it container_name bash
...
docker run -v /host/path:/container/path -d app

Recommendation

Mount only intended directories, avoid root shells unless necessary, and review container/image trust before exposing host paths.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The publisher/source identity is slightly less clear than expected.

Why it was flagged

The packaged metadata differs from the registry metadata shown for owner and slug. There is no code or install script affected, but this is a provenance consistency note.

Skill content

"ownerId": "kn7anq2d7gcch060anc2j9cg89800dyv",
  "slug": "docker-essentials"

Recommendation

Verify that this is the intended Docker reference skill and prefer trusted publishers or official Docker documentation when in doubt.