xCloud Docker Deploy

• Outcome: Review
• Latest audit: May 29, 2026 at 9:22 PM UTC
• Version:
  1.2.1

Overview

This deployment skill appears coherent, but it gives broad production-deployment guidance with sensitive secret handling and automatic database migration steps that need human review before use.

Review this skill before installing. If you use it, keep real secrets only in your hosting provider's encrypted environment variables or CI secret store, never in committed files, and treat any production database migration step as requiring a backup, staging test, and explicit approval. The issues look like under-scoped deployment guidance rather than deception or malware.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The deployment instructions explicitly tell users to provide sensitive values such as DATABASE_URL, JWT_SECRET, and POSTGRES_PASSWORD, but give no guidance on using a secrets manager, platform secret store, or avoiding committing secrets to source control. In a deployment skill, this omission is security-relevant because users commonly copy values into repo files, CI variables, or compose files insecurely, which can lead to credential exposure and compromise of the application or database.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The deployment hook runs `php artisan migrate --force`, which suppresses Laravel's production confirmation prompt and can apply schema changes automatically during deployment. In a generic example without warnings, backup guidance, rollback steps, or review gates, this can cause destructive or irreversible database changes, downtime, or failed deploys if a migration is unsafe.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The deployment steps instruct users to run `php artisan migrate --force` directly in production without any warning, backup guidance, or rollout safeguards. While standard for non-interactive deployments, `--force` suppresses confirmation prompts and can apply destructive schema changes automatically, increasing the chance of irreversible production data loss or downtime if migrations are unsafe.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest markets the skill as able to deploy 'any project' and lists many supported stacks/platforms, but it does not define meaningful trigger constraints, exclusions, or safety boundaries. In an agent ecosystem, this kind of broad scope can cause the skill to activate in unrelated contexts and influence sensitive deployment, CI/CD, Docker, or environment-generation workflows more often than intended, increasing the chance of unsafe or inappropriate automation.

VirusTotal

64/64 vendors flagged this skill as clean.