Docker Cleanup Toolkit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 1.0.0

Overview

This Docker cleanup skill is purpose-aligned but needs Review because it promotes forceful Docker pruning without prominent data-loss warnings and its report loads a third-party stylesheet.

Install only if you are comfortable letting the agent inspect Docker resources and, when explicitly asked, prune them. Run analysis first, review what Docker considers unused, and avoid `--force`, `--volumes`, or broad cleanup on systems with important containers or database volumes unless you have backups. Be aware that opening an HTML report contacts jsDelivr for CSS.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: scripts/docker_cleanup.py:445

Finding

Externally Loaded Stylesheet Without Subresource Integrity

Content

View full analysis

Docker Cleanup Report body {{ font-family: 'Segoe UI', sans-serif; padding: 2rem; background: #1a1a2e; color: #e0e0e0; }} ``` ### Technical Analysis The generated HTML report loads Bootstrap CSS from the third-party jsDelivr CDN. The resource is not protected by a Subresource Integrity (`integrity`) attribute, so the browser cannot verify that the downloaded content matches an audited version. Although the URL pins Bootstrap to version `5.3.0`, delivery still depends on the CDN, DNS resolution, TLS trust chain, and the continued integrity of the hosted asset. The external request also conflicts with the documented expectation that the tool operates using standard-library functionality only, because opening the generated report introduces a runtime web dependency. CSS does not ordinarily provide direct arbitrary script execution in modern browsers. Nevertheless, malicious or compromised CSS could alter or conceal report content, create misleading visual elements, and trigger further external resource requests. Loading the report also discloses connection metadata—including the viewer's IP address, browser user agent, and access time—to the CDN. ### Attack Path 1. A user runs the tool with the `--report` option. 2. The script creates a local HTML report containing the external stylesheet reference. 3. The user opens that report in a web browser while connected to a network. 4. The browser automatically requests Bootstrap CSS from `cdn.jsdelivr.net`. 5. If the CDN asset, delivery infrastructure, DNS path, or trusted TLS endpoint has been compromised, attack ...[truncated 834 chars]

Remediation

View remediation

` element and inline the required CSS in the generated HTML. This eliminates network access and third-party availability or integrity risks when the report is opened. 2. **Alternatively, bundle the stylesheet locally.** Ship an audited Bootstrap CSS file with the project and embed its contents during report generation. Pin and periodically review the bundled version. 3. **If remote hosting is unavoidable, add Subresource Integrity.** Use a verified cryptographic hash and anonymous cross-origin mode: ```html ``` The hash must be generated or obtained from a trusted source and independently verified against the exact referenced file. 4. **Apply a restrictive Content Security Policy.** For a self-contained report, add a policy that blocks network access and executable content, such as: ```html ``` 5. **Document any retained network behavior.** If the external dependency remains, clearly disclose that opening the generated report contacts a third-party CDN. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The 'Full spring cleaning' workflow promotes --all --force, which combines broad deletion with auto-confirmation and no nearby warning about irreversible effects. In the context of Docker administration, this can rapidly remove images, stopped containers, unused volumes, and networks, causing data loss, broken development environments, or service outages.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises shell execution and report generation behavior but does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens policy enforcement and reviewability, increasing the chance an agent invokes shell or file-writing actions without clear, least-privilege boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented prune commands remove Docker resources, including volumes and networks, but the skill does not prominently warn that these actions may delete persistent data or disrupt running environments. In an agent setting, users may treat cookbook-style commands as safe defaults and trigger irreversible cleanup with insufficient review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

| `python3 docker_cleanup.py --volumes` | Prune unused volumes |
| `python3 docker_cleanup.py --networks` | Prune unused networks |
| `python3 docker_cleanup.py --all` | Full system prune (all of the above) |
| `python3 docker_cleanup.py --all --force` | Auto-confirm all pruning |
| `python3 docker_cleanup.py --json` | JSON output for programmatic use |
| `python3 docker_cleanup.py --report` | Generate HTML report |
| `python3 docker_cleanup.py --analyze` | Explicit analysis mode |

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/docker_cleanup.py (reported line 25)May include surrounding context.

python

def run_docker(cmd, capture=True, timeout=60):
    """Run docker command, return (success, stdout, stderr)."""
    try:
        r = subprocess.run(
            ["docker"] + cmd,
            capture_output=capture,
            text=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generated HTML report loads Bootstrap CSS from a third-party CDN, causing network access and metadata disclosure when the report is opened. This creates an unnecessary external dependency for a local cleanup tool and can leak host usage patterns, report access timing, and user IP information to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code exposes multiple prune actions, including full system prune and volume/image/container/network cleanup, which can delete Docker resources and potentially remove user data. Although the CLI help names the actions and notes that --force disables confirmation prompts, it does not clearly warn about the destructive and potentially irreversible impact of these operations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/docker_cleanup.py (reported line 484)May include surrounding context.

python

parser.add_argument("--volumes", action="store_true", help="Prune unused volumes")
    parser.add_argument("--networks", action="store_true", help="Prune unused networks")
    parser.add_argument("--analyze", action="store_true", help="Analyze unused resources (dry-run)")
    parser.add_argument("--force", "-f", action="store_true", help="Force (no confirmation prompts)")
    parser.add_argument("--json", action="store_true", help="JSON output")
    parser.add_argument("--report", "-r", action="store_true", help="Generate HTML report")
    parser.add_argument("--no-header", action="store_true", help="Skip overview header")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The generated report sets the document language to English via lang="en", which imposes a specific locale choice in user-facing output. The file does not offer a language/locale option or document a justified region-specific requirement for this constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring and CLI description consistently present this file as a Docker cleanup toolkit. The generated HTML footer instead labels it as "ssl-report," which is an active contradiction in embedded output text rather than a mere omission.

Content

No source excerpt is available for this finding.