ClawHub
Back to skill

Security audit

Docker

Security checks across malware telemetry and agentic risk

Overview

This Docker skill does what it says, but it gives an agent high-impact Docker authority, including privileged host setup, remote image publishing, and builder/cache cleanup without enough explicit user-facing guardrails.

Review this skill before installing on a workstation or CI runner with valuable Docker state or registry credentials. Only use it when you trust the Docker context, builder name, destination image tags, and registry login, and expect it to modify buildx/binfmt setup and publish images remotely.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documented workflow performs a build-and-push operation but does not prominently warn that it will publish images to a remote registry. In an agentic setting, this can cause unintended disclosure of proprietary code, secrets baked into images, or accidental publication of internal artifacts if a user or upstream task misunderstands the action.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script launches a privileged container (`docker run --privileged`) and pulls `tonistiigi/binfmt:latest`, which grants broad host-level capabilities and relies on a mutable image tag. In the context of an agent skill, this is dangerous because invocation may occur non-interactively and without clear disclosure, so running the skill can unexpectedly modify the host kernel binfmt configuration with effectively root-equivalent container privileges.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script unconditionally invokes `docker_buildx_destroy.sh` before initialization, which may delete an existing builder and associated cache without warning. In an automation/skill context this can cause data loss, disrupt concurrent builds, or destroy another workflow's builder state unexpectedly.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.