Docker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:52 AM UTC
• Version: 1.0.6

Overview

This Docker skill is mostly purpose-aligned, but it can run an unpinned third-party container with privileged host access during build setup.

Install only on a trusted, disposable, or dedicated Docker build host. Before using Build Init or Build and Push, understand that it may change host binfmt settings, pull and run an unpinned privileged third-party image, push images to the configured registry, and optionally delete system-wide buildx cache. Prefer pinning the binfmt image by digest and reviewing target tags before invocation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/docker_buildx_init.sh:19

Finding

Unpinned External Container Executes with Privileged Host Access

Content

View full analysis

Vulnerability Details

File Location: scripts/docker_buildx_init.sh, lines 19–20
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Complete Code Snippet:

bash

# Register cross-platform emulators for multi-architecture builds
docker run --privileged --rm tonistiigi/binfmt:latest --install all

Technical Analysis

The initialization script executes the external tonistiigi/binfmt container using both the mutable latest tag and Docker's unrestricted --privileged mode. The dependency is not pinned to a reviewed, immutable image digest. Consequently, the image content executed during a future invocation can differ from the content reviewed during this audit.

Registering binfmt handlers is related to the declared multi-architecture build functionality, but the combination of a mutable dependency and privileged execution creates a high-impact supply-chain trust boundary. If the upstream image, publishing account, registry path, or mutable tag is compromised, attacker-controlled code would execute with extensive access to host kernel interfaces and devices.

The --rm option only removes the container after execution. It neither constrains its privileges nor reverses changes that it makes to the host while running.

Attack Path

1. An attacker compromises the upstream image publisher, registry repository, publishing credentials, or the content referenced by tonistiigi/binfmt:latest.
2. The attacker publishes a malicious replacement under the same mutable latest tag.
3. A user invokes the Build Init workflow, or the Build and Push workflow that calls Build Init.
4. Docker resolves and runs the attacker-controlled image without verifying a fixed digest.
5. The malicious container executes under --privileged, accesses host-exposed kernel and device interfaces, and makes unauthorized host changes.
6. Container removal does not undo host modifications, credential access, ...[truncated 720 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable tag with a reviewed immutable digest:

   bash

   docker run --privileged --rm \
     tonistiigi/binfmt@sha256:REVIEWED_IMMUTABLE_DIGEST \
     --install all
   

2. Establish a controlled dependency-update process that verifies the image's publisher, digest, provenance, signatures, and release notes before changing the pinned digest.

3. Enforce signature or provenance verification through the deployment environment where supported.

4. Prefer configuring emulation once through trusted host provisioning rather than downloading and executing a privileged container during every Skill invocation.

5. If runtime registration remains necessary, request explicit user approval immediately before privileged execution and clearly disclose that it modifies host-level binfmt configuration.

6. Reduce privileges where technically possible, limit the installed emulators to the architectures actually requested, and isolate this operation on a dedicated build host with no unrelated workloads or sensitive credentials.

7. Configure registry allowlists or an approved internal mirror so the privileged image can only originate from a controlled source.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code chunk exclusively implements the 'Build and Push' behavior via docker buildx build --push .. It does not inspect manifests, initialize a builder, or destroy a builder. Since the declared purpose lists multiple interfaces/capabilities but the actual code provided covers only one of them, the description does not accurately represent this specific code chunk. There are no obvious undeclared extra capabilities beyond build-and-push, but there is a clear scope mismatch between the broader declared description and the narrower actual behavior.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

## Important Principles ⭐

**Modification Prohibited (Mandatory)**: Any files under `skill-docker`. This skill is maintained via
`openclaw skills update skill-docker`; any alterations will disrupt its normal operation.

## skill-docker:interface-01 - Manifest Inspect

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Using docker run --privileged grants the container extensive access to the host, including device access and elevated kernel-facing capabilities. Even though binfmt registration is a legitimate use case, combining privileged mode with a remotely pulled image means a compromised or malicious image could modify the host or facilitate container escape-like impact.

Content

Scanner excerpt · scripts/docker_buildx_init.sh (reported line 21)May include surrounding context.

sh

fi

# Register cross-platform emulators for multi-architecture builds
docker run --privileged --rm tonistiigi/binfmt:latest --install all

# Clean up any existing builder and build cache before initialization
bash ./docker_buildx_destroy.sh

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill provides a build-and-push workflow that publishes container images to a remote registry, but it does not prominently warn that the action is external and potentially irreversible. In an agent context, this increases the risk of accidental publication of sensitive code, proprietary images, or incorrectly tagged artifacts to public or production registries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

When DOCKER_PRUNE_FIRST=true, the script runs 'docker buildx prune -a -f', which removes cached buildx resources system-wide rather than limiting cleanup to the named builder being destroyed. In a shared host, CI runner, or developer machine, this can unexpectedly delete caches used by other builds, causing disruption, slower rebuilds, and possible interference beyond the skill's stated 'Build Destroy' scope.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script pulls and executes tonistiigi/binfmt:latest without pinning to a specific tag or digest, which creates supply-chain risk because future image changes or a compromised registry account could alter what runs. This is especially dangerous here because the container is executed with --privileged, giving the pulled image broad host-level capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script performs two impactful actions automatically: running a privileged container and destroying any existing buildx builder/cache via docker_buildx_destroy.sh, but it provides no prompt, dry-run mode, or explicit warning. In an agent skill context, that increases operational risk because users may trigger host-modifying and destructive behavior without realizing it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill exposes an option to remove all build cache, including internal/frontend images, but presents it without a strong destructive-action warning. This can cause unexpected loss of local build state, slower rebuilds, and disruption of other workflows sharing the Docker environment.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/docker_buildx_init.sh (reported line 21)May include surrounding context.

sh

fi

# Register cross-platform emulators for multi-architecture builds
docker run --privileged --rm tonistiigi/binfmt:latest --install all

# Clean up any existing builder and build cache before initialization
bash ./docker_buildx_destroy.sh

Static analysis

No suspicious patterns detected.