ClawHub
Back to skill

Security audit

Docker Helper

Security checks for vulnerabilities and agentic risk

Overview

This Docker helper is not outright malicious, but it should be reviewed because it can generate unsafe Docker Compose configurations and includes an under-disclosed generic workflow script with local history logging.

Review the generated Docker Compose output before using it. Replace all default passwords, avoid publishing databases or admin consoles to every network interface, keep Elasticsearch security enabled, and treat cleanup commands as destructive. Also be aware that the bundled generic script logs command usage under a local docker-helper data directory despite not being part of the advertised Docker helper scope.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/docker.sh:267
Finding

Generated Compose Services Use Weak Credentials and Unsafe Network Exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill's declared purpose is narrowly Docker-focused, but the analyzed behavior indicates generic workflow automation, undeclared local data/history handling, and absence of the advertised Docker-specific functions. This mismatch is dangerous because users and orchestrators may trust and invoke the skill under false assumptions, enabling unexpected command execution, data persistence, or broader system interaction than the description implies.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/docker.sh (reported line 146)May include surrounding context.

sh
FROM nginx:1.25-alpine
# Remove default config
RUN rm /etc/nginx/conf.d/default.conf
# Copy custom config
COPY nginx.conf /etc/nginx/nginx.conf
COPY conf.d/ /etc/nginx/conf.d/

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/docker.sh (reported line 187)May include surrounding context.

sh
print("\n# .dockerignore (recommended):")
    ignore_common = '''node_modules
.git
.env
*.log
.DS_Store
docker-compose*.yml

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/docker.sh (reported line 509)May include surrounding context.

sh
print("\n# .dockerignore (recommended):")
    ignore_common = '''node_modules
.git
.env
*.log
.DS_Store
docker-compose*.yml

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/docker.sh (reported line 606)May include surrounding context.

sh
'name': 'GitHub Container Registry',
        'login': 'echo $PAT | docker login ghcr.io -u <username> --password-stdin',
        'push': '''# 创建PAT (需container权限)
# Settings > Developer settings > Personal access tokens

# 登录
echo $GITHUB_TOKEN | docker login ghcr.io -u <username> --password-stdin

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/docker.sh (reported line 625)May include surrounding context.

sh
#     username: ${{ github.actor }}
#     password: ${{ secrets.GITHUB_TOKEN }}''',
        'notes': '''注意:
- 需要Personal Access Token(PAT)
- 默认私有, 可设为公开
- 与GitHub仓库关联
- Actions中可用GITHUB_TOKEN'''

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tips.md (reported line 24)May include surrounding context.

md
## 镜像优化要点
- Alpine基础镜像: ~5MB vs Ubuntu ~70MB
- 多阶段构建: 编译与运行分离
- 清理缓存: `apt-get clean && rm -rf /var/lib/apt/lists/*`
- 合并COPY指令
- 使用 `docker image prune` 清理无用镜像

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tips.md (reported line 24)May include surrounding context.

md
## 镜像优化要点
- Alpine基础镜像: ~5MB vs Ubuntu ~70MB
- 多阶段构建: 编译与运行分离
- 清理缓存: `apt-get clean && rm -rf /var/lib/apt/lists/*`
- 合并COPY指令
- 使用 `docker image prune` 清理无用镜像

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tips.md (reported line 24)May include surrounding context.

md
## 镜像优化要点
- Alpine基础镜像: ~5MB vs Ubuntu ~70MB
- 多阶段构建: 编译与运行分离
- 清理缓存: `apt-get clean && rm -rf /var/lib/apt/lists/*`
- 合并COPY指令
- 使用 `docker image prune` 清理无用镜像

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · tips.md (reported line 24)May include surrounding context.

md
## 镜像优化要点
- Alpine基础镜像: ~5MB vs Ubuntu ~70MB
- 多阶段构建: 编译与运行分离
- 清理缓存: `apt-get clean && rm -rf /var/lib/apt/lists/*`
- 合并COPY指令
- 使用 `docker image prune` 清理无用镜像

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises executable commands and static analysis detected shell and network capabilities, but the manifest declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may invoke broader capabilities than users expect, increasing the risk of command execution or outbound access without clear consent boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The phrase "专为中文用户设计，理解中国市场和文化" explicitly frames the skill around a specific language/locale audience. The file does not indicate any user opt-in or alternative language/locale support, so this is a natural-language locale policy concern under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This shell script's user-facing help and command descriptions are presented in Chinese, and the same language choice continues throughout the skill output strings. Because the file does not offer an English/locale option or explain that it is intentionally region-specific, it constitutes a language/locale policy issue under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/docker.sh (reported line 92)May include surrounding context.

sh
USER appuser
EXPOSE 8000
HEALTHCHECK --interval=30s --timeout=3s \\
  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1
CMD ["python", "app.py"]''',

    'java': '''# Java Dockerfile

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The cheat sheet and debug guidance include destructive cleanup commands such as docker rm -f $(docker ps -aq), docker system prune, and docker system prune -a without adjacent warnings about deleting containers, images, networks, or volumes. In a helper skill context, users may copy-paste these commands directly, increasing the risk of accidental local data loss or service disruption.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script and help text present a generic developer workflow automation tool rather than a Docker-specific helper, which creates a capability mismatch with the declared skill purpose. In an agent setting, this can mislead users or higher-level orchestration into invoking a broader tool than expected, increasing the risk of inappropriate execution, hidden side effects, and trust-boundary violations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The inline documentation advertises unrelated project automation features such as init, build, test, deploy, and clean, contradicting the stated Docker-helper intent. This inconsistency is dangerous in a skill ecosystem because users and agents may grant the tool Docker-scoped trust while it exposes a broader operational interface, enabling misuse or unintended workflow actions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/docker.sh (reported line 498)May include surrounding context.

sh
║    RUN apt-get clean                                         ║
║  ✓ RUN apt-get update && \                                   ║
║      apt-get install -y --no-install-recommends curl && \    ║
║      apt-get clean && rm -rf /var/lib/apt/lists/*            ║
║                                                              ║
║  ── 4. 利用构建缓存 ──                                       ║
║  COPY package.json .    ← 先复制依赖文件                     ║

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/docker.sh (reported line 498)May include surrounding context.

sh
║    RUN apt-get clean                                         ║
║  ✓ RUN apt-get update && \                                   ║
║      apt-get install -y --no-install-recommends curl && \    ║
║      apt-get clean && rm -rf /var/lib/apt/lists/*            ║
║                                                              ║
║  ── 4. 利用构建缓存 ──                                       ║
║  COPY package.json .    ← 先复制依赖文件                     ║

Static analysis

No suspicious patterns detected.