Back to skill
Skillv2.0.0
ClawScan security
Docker Helper · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 17, 2026, 6:55 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with its stated Docker helper purpose: included scripts generate Dockerfiles/docker‑compose snippets and provide local CLI helpers — no unexpected credentials, remote installs, or hidden network exfiltration were found.
- Guidance
- This skill appears to be what it claims: template generators and local helper scripts. Before installing, note: (1) the included docker-compose templates contain sensible but plain default credentials — replace them with secure secrets and avoid committing them to source control; (2) the helper creates a local data directory (defaults to ~/.local/share/docker-helper) where it writes history/logs (you can set DOCKER_HELPER_DIR to change this); (3) Dockerfile and compose snippets include HEALTHCHECK lines that use wget as examples — those are part of the generated files and not executed by the skill itself. If you plan to run the included scripts on sensitive machines, inspect/modify templates to match your security policies. Overall, no indications of credential exfiltration, hidden endpoints, or unexpected installations were found.
Review Dimensions
- Purpose & Capability
- okName/description (Dockerfile, compose, commands, debug, optimize, registry) match the provided assets: SKILL.md, templates and helper scripts that generate Dockerfiles and docker‑compose snippets and provide command/help text. The included scripts implement the advertised features.
- Instruction Scope
- okSKILL.md contains only usage, command list and examples; it does not instruct the agent to read unrelated files, exfiltrate data, or contact external endpoints. The scripts produce templates and local helper output; they do not read arbitrary system configuration or transmit data off‑host.
- Install Mechanism
- okNo install spec is declared and no external downloads occur. The skill is instruction + local scripts only (no network fetches during install). This is the lowest‑risk install model.
- Credentials
- okThe skill declares no required environment variables or credentials. The scripts optionally respect DOCKER_HELPER_DIR/XDG_DATA_HOME/HOME for a data directory and the compose templates include standard environment placeholders/defaults (e.g., MYSQL_ROOT_PASSWORD) — these are template defaults, not required secrets.
- Persistence & Privilege
- okalways is false and the skill does not modify other skills or system settings. The helper creates a local data directory (~/.local/share/docker-helper by default) and logs actions there — this is limited, local persistence consistent with a CLI helper.