Security audit
Security checks for vulnerabilities and agentic risk
This Docker operations skill is mostly coherent, but it includes high-impact Docker and sudo guidance that can delete data or grant persistent root-equivalent access without enough guardrails.
Review this skill before installing. Use dry-run and explicit confirmation for cleanup, avoid docker compose down -v unless you intend to delete volumes, do not add users to the docker group without administrator approval, and harden any copied Compose templates by requiring real secrets and avoiding public database port exposure.
SKILL.md:146Docker Group Recommendation Grants Persistent Root-Equivalent Access
references/compose-patterns.md:12Predictable Database Password and Unrestricted Host Port Publication in Compose Pattern
Referenced artifact was not completely inspected
- **`references/compose-patterns.md`** — Docker Compose patterns and recipes
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
start_period: 40s
## .env File Template
PORT=3000
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
start_period: 40s
## .env File Template
PORT=3000
The skill clearly instructs the agent to run shell-based Docker administration commands, but the manifest declares no explicit tool scope or allowed-tools. In an agent environment, this widens ambiguity around what the skill is permitted to execute and increases the chance of unintended or overly broad command execution against the host Docker daemon.
The cleanup section documents commands that remove Docker resources, including an aggressive mode that removes volumes and build cache, but does not provide a prominent warning about irreversible data loss. In an agentic context, this is dangerous because cleanup commands are easy to execute mechanically and can delete containers, caches, and persistent data needed for recovery.
docker compose down -v removes associated volumes, which often contain persistent application data such as databases. Without a clear warning, an operator or agent may treat it as a routine stop command and irreversibly destroy stateful service data.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Find what's using a port
sudo lsof -i :<port>
docker ps --format '{{.Names}} {{.Ports}}' | grep <port>
# Fix: change port mapping in docker-compose.yml or stop conflicting container
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
The example uses docker run --rm -v <volume>:/data alpine ... without pinning the utility image to a tag or digest. In a real environment this can pull an unexpected or compromised image, turning a simple volume inspection step into a supply-chain exposure with access to mounted data.
Adding a user to the docker group effectively grants root-equivalent access on many systems because Docker can mount the host filesystem, run privileged containers, and control the daemon. Presenting this as a routine fix without warning understates the privilege escalation implications.
# Add user to docker group
sudo usermod -aG docker $USER && newgrp docker
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
DB_PORT=5432 DB_USER=app DB_PASSWORD=change_me_in_prod NODE_ENV=development
## Useful Compose Commands
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if since:
cmd.extend(["--since", since])
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
return result.stdout + result.stderr
except subprocess.TimeoutExpired:
print("⚠️ docker logs timed out", file=sys.stderr)
The image management section includes pruning and image removal commands without clearly warning that local images will be deleted and may require re-pull or rebuild. This is primarily an availability and operational safety issue rather than a direct security exploit, but it can still disrupt deployments and incident response workflows.
Detected: suspicious.exposed_secret_literal