ClawHub
Back to skill

Security audit

Docker Cleanup Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This Docker cleanup skill is purpose-aligned but needs Review because it promotes forceful Docker pruning without prominent data-loss warnings and its report loads a third-party stylesheet.

Install only if you are comfortable letting the agent inspect Docker resources and, when explicitly asked, prune them. Run analysis first, review what Docker considers unused, and avoid `--force`, `--volumes`, or broad cleanup on systems with important containers or database volumes unless you have backups. Be aware that opening an HTML report contacts jsDelivr for CSS.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
scripts/docker_cleanup.py:445
Finding
Externally Loaded Stylesheet Without Subresource Integrity<![CDATA[ ## Vulnerability Details **File Location**: `scripts/docker_cleanup.py`, lines 445–448 **Vulnerability Type**: Unverified third-party web dependency **Risk Level**: Low ### Vulnerable Code ```python html = f"""<!DOCTYPE html> <html lang="en"> <head><meta charset="UTF-8"><title>Docker Cleanup Report</title> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet"> <style>body {{ font-family: 'Segoe UI', sans-serif; padding: 2rem; background: #1a1a2e; color: #e0e0e0; }} ``` ### Technical Analysis The generated HTML report loads Bootstrap CSS from the third-party jsDelivr CDN. The resource is not protected by a Subresource Integrity (`integrity`) attribute, so the browser cannot verify that the downloaded content matches an audited version. Although the URL pins Bootstrap to version `5.3.0`, delivery still depends on the CDN, DNS resolution, TLS trust chain, and the continued integrity of the hosted asset. The external request also conflicts with the documented expectation that the tool operates using standard-library functionality only, because opening the generated report introduces a runtime web dependency. CSS does not ordinarily provide direct arbitrary script execution in modern browsers. Nevertheless, malicious or compromised CSS could alter or conceal report content, create misleading visual elements, and trigger further external resource requests. Loading the report also discloses connection metadata—including the viewer's IP address, browser user agent, and access time—to the CDN. ### Attack Path 1. A user runs the tool with the `--report` option. 2. The script creates a local HTML report containing the external stylesheet reference. 3. The user opens that report in a web browser while connected to a network. 4. The browser automatically requests Bootstrap CSS from `cdn.jsdelivr.net`. 5. If the CDN asset, delivery infrastructure, DNS path, or trusted TLS endpoint has been compromised, attack ...[truncated 834 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. **Prefer a fully self-contained report.** Remove the external `<link>` element and inline the required CSS in the generated HTML. This eliminates network access and third-party availability or integrity risks when the report is opened. 2. **Alternatively, bundle the stylesheet locally.** Ship an audited Bootstrap CSS file with the project and embed its contents during report generation. Pin and periodically review the bundled version. 3. **If remote hosting is unavoidable, add Subresource Integrity.** Use a verified cryptographic hash and anonymous cross-origin mode: ```html <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" integrity="VERIFIED-SHA384-HASH" crossorigin="anonymous"> ``` The hash must be generated or obtained from a trusted source and independently verified against the exact referenced file. 4. **Apply a restrictive Content Security Policy.** For a self-contained report, add a policy that blocks network access and executable content, such as: ```html <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src data:"> ``` 5. **Document any retained network behavior.** If the external dependency remains, clearly disclose that opening the generated report contacts a third-party CDN. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Missing User Warnings

High
Confidence
97% confidence
Finding
The 'Full spring cleaning' workflow promotes `--all --force`, which combines broad deletion with auto-confirmation and no nearby warning about irreversible effects. In the context of Docker administration, this can rapidly remove images, stopped containers, unused volumes, and networks, causing data loss, broken development environments, or service outages.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises shell execution and report generation behavior but does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens policy enforcement and reviewability, increasing the chance an agent invokes shell or file-writing actions without clear, least-privilege boundaries.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documented prune commands remove Docker resources, including volumes and networks, but the skill does not prominently warn that these actions may delete persistent data or disrupt running environments. In an agent setting, users may treat cookbook-style commands as safe defaults and trigger irreversible cleanup with insufficient review.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| `python3 docker_cleanup.py --volumes` | Prune unused volumes |
| `python3 docker_cleanup.py --networks` | Prune unused networks |
| `python3 docker_cleanup.py --all` | Full system prune (all of the above) |
| `python3 docker_cleanup.py --all --force` | Auto-confirm all pruning |
| `python3 docker_cleanup.py --json` | JSON output for programmatic use |
| `python3 docker_cleanup.py --report` | Generate HTML report |
| `python3 docker_cleanup.py --analyze` | Explicit analysis mode |
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_docker(cmd, capture=True, timeout=60):
    """Run docker command, return (success, stdout, stderr)."""
    try:
        r = subprocess.run(
            ["docker"] + cmd,
            capture_output=capture,
            text=True,
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The generated HTML report loads Bootstrap CSS from a third-party CDN, causing network access and metadata disclosure when the report is opened. This creates an unnecessary external dependency for a local cleanup tool and can leak host usage patterns, report access timing, and user IP information to an external service.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This code exposes multiple prune actions, including full system prune and volume/image/container/network cleanup, which can delete Docker resources and potentially remove user data. Although the CLI help names the actions and notes that --force disables confirmation prompts, it does not clearly warn about the destructive and potentially irreversible impact of these operations.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
parser.add_argument("--volumes", action="store_true", help="Prune unused volumes")
    parser.add_argument("--networks", action="store_true", help="Prune unused networks")
    parser.add_argument("--analyze", action="store_true", help="Analyze unused resources (dry-run)")
    parser.add_argument("--force", "-f", action="store_true", help="Force (no confirmation prompts)")
    parser.add_argument("--json", action="store_true", help="JSON output")
    parser.add_argument("--report", "-r", action="store_true", help="Generate HTML report")
    parser.add_argument("--no-header", action="store_true", help="Skip overview header")
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The generated report sets the document language to English via lang="en", which imposes a specific locale choice in user-facing output. The file does not offer a language/locale option or document a justified region-specific requirement for this constraint.

Intent-Code Divergence

Low
Confidence
98% confidence
Finding
The module docstring and CLI description consistently present this file as a Docker cleanup toolkit. The generated HTML footer instead labels it as "ssl-report," which is an active contradiction in embedded output text rather than a mere omission.

Static analysis

No suspicious patterns detected.