ClawHub
Back to skill

Security audit

Docker Container Cleaner

Security checks for vulnerabilities and agentic risk

Overview

This Docker cleanup skill is purpose-aligned, but its implementation can delete Docker resources without the confirmations its documentation promises.

Review carefully before installing or running. Treat cleanup commands as destructive even without --force, avoid using this against production or remote Docker contexts, do not rely on dry-run volume/network counts as an exact deletion plan, and make backups before any volume cleanup.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/main.py:257
Finding

Destructive Docker Cleanup Silently Bypasses Confirmation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/main.py:187
Finding

Dry-Run Incorrectly Reports Every Volume and Network as Unused

Content
View full analysis
Dict[str, Any]: """Clean up unused volumes.""" if dry_run: volumes = get_volumes_info() return { "operation": "clean_volumes", "dry_run": True, "would_remove": volumes["unused_count"] } ``` ```python def clean_networks(force: bool = False, dry_run: bool = False) -> Dict[str, Any]: """Clean up unused networks.""" if dry_run: networks = get_networks_info() return { "operation": "clean_networks", "dry_run": True, "would_remove": networks["unused_count"] } ``` ### Technical Analysis The discovery functions assign `unused_count` to the total number of discovered volumes or networks without inspecting container mounts or network attachments. At the same time, the corresponding `unused` lists remain empty. ...[truncated 2016 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:12
Finding

Documentation Recommends Installing an Unpinned and Unused Dependency

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Stopped-container cleanup always appends --force, even when the caller did not request force. That removes any meaningful confirmation barrier in a destructive tool and makes accidental or automated invocation far more dangerous, especially in environments where stopped containers may be retained for forensics or recovery.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Image cleanup performs forced deletion without any effective confirmation, and --all may expand the scope significantly beyond dangling images. In a container-management context, that can break builds, deployments, or recovery workflows by deleting cached or needed images unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
100% confidence
Finding

Volume cleanup permanently deletes data-bearing Docker volumes while always forcing the prune operation. Because volumes often contain persistent application databases or state, this behavior creates a serious risk of irreversible data loss from accidental execution or misleading dry-run output.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md
# Remove dangling images only
python3 scripts/main.py clean --images --dangling

# Force cleanup of everything (no confirmation)
python3 scripts/main.py clean --all --force

# Dry run (show what would be removed)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 69)May include surrounding context.

md
- `--volumes`: Remove unused volumes
- `--networks`: Remove unused networks
- `--all`: Clean all resource types (equivalent to --containers --images --volumes --networks)
- `--force`: Skip confirmation prompts
- `--dry-run`: Show what would be removed without actually removing
- `--yes`: Auto-answer "yes" to all prompts
- `--no-interactive`: Disable interactive mode (use with --yes for scripts)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/main.py (reported line 611)May include surrounding context.

python
- `--volumes`: Remove unused volumes
- `--networks`: Remove unused networks
- `--all`: Clean all resource types (equivalent to --containers --images --volumes --networks)
- `--force`: Skip confirmation prompts
- `--dry-run`: Show what would be removed without actually removing
- `--yes`: Auto-answer "yes" to all prompts
- `--no-interactive`: Disable interactive mode (use with --yes for scripts)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 172)May include surrounding context.

If permission denied:

text
❌ Permission denied. You may need to run with sudo or add your user to the docker group.

If timeout occurs:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises shell-capable behavior via Docker and Python CLI usage but does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing tool restrictions can let the skill invoke powerful local commands against the host Docker daemon, increasing the blast radius of misuse or prompt-injection-driven execution.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The documented '--force' mode enables destructive cleanup with no confirmation, which is an autonomous destructive action against local Docker resources. In this skill's context, that is especially dangerous because Docker cleanup can remove containers, images, volumes, and networks, causing data loss or service disruption if triggered unintentionally or by a compromised agent workflow.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

python3 scripts/main.py clean --networks

text

Force cleanup (no confirmation):
```bash
python3 scripts/main.py clean --all --force

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 18)May include surrounding context.

python
def check_docker_available() -> bool:
    """Check if Docker is installed and running."""
    try:
        result = subprocess.run(["docker", "version"], 
                              capture_output=True, text=True, timeout=5)
        return result.returncode == 0
    except (subprocess.TimeoutExpired, FileNotFoundError):

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 28)May include surrounding context.

python
"""Run a docker command and return standardized result."""
    start_time = time.time()
    try:
        result = subprocess.run(
            ["docker"] + cmd,
            capture_output=True,
            text=True,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The status/dry-run logic reports all volumes as unused even though it does not verify actual attachment or use. In a cleanup tool, this is dangerous because it can mislead users into authorizing deletion of important persistent data volumes, increasing the risk of irreversible data loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code marks all networks as unused without checking whether containers are attached. This can misrepresent cleanup impact and cause users to remove networks that are operationally important, leading to application connectivity failures or service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Network cleanup also forces prune without meaningful confirmation. Although typically less severe than volume deletion, unexpected removal of Docker networks can disrupt service communication, break local development environments, and complicate incident recovery.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The --unused option is documented in a way that suggests careful identification of images not used by any container, but the implementation relies on docker image prune --all. While Docker's prune behavior is valid, the mismatch between advertised semantics and actual action can cause broader-than-expected deletion and operational disruption.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.