Docker

• Outcome: Review
• Latest audit: Jul 27, 2026 · 8:50 AM UTC
• Version: 1.0.10

Overview

This Docker skill is a disclosed local helper that runs Docker-oriented workflows and keeps local operational notes, with no evidence of hidden exfiltration or deceptive behavior.

Install only if you are comfortable with the agent using Docker commands and keeping local Docker operations notes under ~/Clawic/data/, including host, volume, registry-pointer, and deploy metadata. Do not paste secrets expecting them to be saved; the skill is designed to store pointers instead of secret values, and destructive Docker commands still require careful review before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to write project-specific artifacts and memory notes into `~/Clawic/data/docker/...`, which is outside the normal scope of Docker development guidance and creates a side effect on the user's filesystem. Because the path is user-home scoped and framed as a routine step, it can be used to persist project data or operational context without clear user consent, increasing the risk of unintended data retention or covert statefulness across sessions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The command `docker compose down -v` irreversibly deletes named volumes, which often contain databases and other persistent application state. Although the file notes it is destructive, the warning is not embedded as a direct guard at the command point and the surrounding skill is an incident/debugging toolkit, where operators may copy-paste commands quickly under pressure.

Credential Access

High

• Category: Privilege Escalation

Content

## Security & Privacy

**Credentials:** this skill drives the Docker CLI, which reads registry credentials from `~/.docker/config.json` or an OS credential helper. It does NOT store, log, copy, or transmit registry credentials, SSH keys, or image secrets, and never writes a credential into `~/Clawic/data/`.

**Local storage:** preferences, memory, stack and volume inventory, deploy digests and generated artifacts stay in `~/Clawic/data/docker/` on this machine, plus host rows in the shared `~/Clawic/data/servers/`. Image names, digests, ports and volume names only — no secrets.

• Confidence: 72% confidence
• Finding: ~/.docker/config.json

Session Persistence

Medium

• Category: Rogue Agent

Content

- ~/clawic/docker/
---

**Data.** At the start of every session, read `~/Clawic/data/docker/config.yaml` (what the user declared) and `~/Clawic/data/docker/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/servers/servers.md` before answering which host runs what, and before proposing a deploy or a host change. If none of it exists, work from defaults and say nothing about it.

**Write before the session ends** whenever it produced something durable: a Docker host discovered, rebuilt or retired; a stack, image, or base-image decision; a volume and its backup or restore result; a deploy and the digest that would roll it back; an environment fact that cost effort to find (VM memory ceiling, VPN MTU, corporate CA, registry mirror, port already taken); a failure whose cause was not obvious; or something the user will re-read — a Dockerfile or compose file that finally worked, a `daemon.json`, a runbook. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.

• Confidence: 85% confidence
• Finding: write and deletion is named in one line as it happens. Read `~/Clawic/data/servers/servers.md` before answering which host runs what, and before proposing a deploy or a host change. If none of it exis

Session Persistence

Medium

• Category: Rogue Agent

Content

Everything except artifacts, deploy records and the shared inventory begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/docker/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

• Confidence: 77% confidence
• Finding: create the new file in `~/Clawic/data/docker/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file. 3. Keep t

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: compose.md:51

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:57