Security audit

Lazydocker

Security checks across malware telemetry and agentic risk

Overview

This lazydocker skill is coherent, but it needs Review because it under-warns about remote Docker TCP access, destructive cleanup, and diagnostic data exposure.

Install only if you are comfortable letting an agent help manage Docker resources. Prefer SSH or TLS for remote Docker, avoid exposing port 2375, review any prune or delete command before it runs, inspect downloaded install scripts before execution, and redact diagnostic output before sharing it. VirusTotal and static scan were clean; the Review verdict is based on under-disclosed high-impact Docker guidance, not evidence of malware.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The guide explicitly enables AI-assisted configuration of remote Docker access, including an insecure example using DOCKER_HOST=tcp://remote-server:2375 with no warning that unauthenticated Docker TCP access is highly dangerous. Remote Docker control effectively grants root-equivalent control over the host, so normalizing this setup materially expands the skill from local UI usage into remote administrative access.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The guide authorizes AI-assisted cleanup and prune operations that can irreversibly delete containers, images, networks, caches, and volumes, but does not require confirmation or emphasize the destructive nature of these commands. In an AI-assisted context, such bulk deletion increases the risk of accidental data loss or environment disruption.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly promotes destructive Docker actions such as stopping, deleting containers, images, and volumes, but does not warn users about service disruption, irreversible data loss, or the need to confirm targets before acting. In a tool that manages live infrastructure, this omission can lead to accidental deletion of persistent data or outages, especially because the skill frames the AI as guiding and automating these tasks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide instructs users or an AI agent to execute a remote script directly via `curl ... | bash` and elsewhere to move binaries into privileged locations, but it does not warn that this executes unreviewed network content with the user's shell privileges. In an agent context, this is riskier because the wording explicitly encourages automatic execution, reducing human review before running downloaded code.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide appends to `~/.bashrc`/`~/.zshrc` and uses privileged binary locations without warning that these changes are persistent and may affect future shell sessions or system-wide command resolution. In a skill intended for AI-assisted execution, silent persistence changes are especially sensitive because users may not realize their environment is being modified long-term.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The uninstall section includes `sudo rm` and `rm -rf` deletion commands without a warning that they are destructive and irreversible if paths are mistyped or expanded unexpectedly. In an agent-execution setting, destructive filesystem commands deserve extra caution because they could be run automatically without user review.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The cleanup section documents docker system prune and docker system prune --volumes without warning that these operations can permanently remove data, including persistent volumes. Omitting this warning is dangerous because users or an AI agent may treat the commands as routine maintenance and cause irreversible loss.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The remote Docker section shows plain TCP access on port 2375 without warning that this mode is commonly unauthenticated and exposes full Docker daemon control to anyone who can reach it. Since Docker daemon access is effectively root-equivalent on the host, this omission can lead to severe host compromise.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The diagnostic section instructs collecting and displaying local configuration, Docker status, OS details, terminal settings, and the full lazydocker config without any warning about sensitive content. In an agent context, this can cause verbatim disclosure of environment and configuration data that may contain hostnames, paths, registry endpoints, credentials-adjacent settings, or other operationally sensitive details.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The section explicitly says an AI can help collect diagnostic data, then provides commands that dump environment and configuration details directly. That is risky because an AI agent may reveal this information verbatim to external parties or logs, exposing sensitive host and Docker configuration metadata.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.