ClawHub
Back to skill

Security audit

Docker Mirror

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says for Docker image mirror pulls, but it also exposes broad Docker command authority that users should review before installing.

Install only if you intentionally want the agent to use Docker-group authority in a trusted Linux environment. Prefer using it only for explicit docker pull failures or mirror fallback, review any non-pull Docker command before execution, and be aware that fallback pulls may retrieve images from third-party mirrors rather than docker.io.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script explicitly allows any non-`pull` Docker subcommand to be executed via `sg docker -c "docker $*"`. Because the skill's stated purpose is only mirror-assisted image pulling, this creates unnecessary privileged command execution capability and can be abused to run dangerous Docker operations such as `run`, `exec`, or mounting the host filesystem, which may lead to host compromise.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The general Docker command passthrough is unjustified for a tool advertised as a mirror failover helper for image pulls. In the context of `sg docker`, broad Docker access is especially dangerous because membership in the Docker group is commonly equivalent to root-level host control, so exposing arbitrary subcommands materially expands the attack surface beyond the declared function.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger scope is broad enough to activate on nearly any Docker image download request, not just recovery from failed pulls. That can cause the agent to route routine container operations through this skill unnecessarily, increasing the chance of pulling from alternate registries without explicit user intent or review.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill silently falls back to third-party registries, but the documentation does not clearly warn users that images may be sourced from unofficial mirrors. In a security-sensitive supply-chain context, this can lead to users unknowingly trusting mirrored content with different provenance, availability guarantees, or tamper risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.