Dockerfile & Container Reviewer

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:09 PM UTC
• Version: 1.0.0

Overview

The skill is mainly a Dockerfile reviewer, but it asks the agent to remember findings across reviews without clear limits or user control.

Install only if you are comfortable with the skill attempting to keep review-derived notes across runs. For safer use, remove or ignore the self-improvement section so each Dockerfile review is based only on the current conversation and user-supplied files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:85

Finding

Unnecessary Cross-Review State Accumulation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 85–88
Vulnerability Type: Cross-review memory and output manipulation
Risk Level: Medium

Vulnerable Code

markdown

## Self-improvement instructions
After each review, note the most impactful finding. After 20 reviews, surface "Top 3 Dockerfile mistakes" at the start of the response.

Technical Analysis

The Skill’s declared purpose is to review Dockerfiles and Docker Compose files supplied for the current task. Recording findings across reviews and using them to modify subsequent responses is unnecessary for that functionality.

The instruction implicitly encourages the Agent to retain review-derived information in cross-task or persistent state. It does not define memory isolation, retention limits, user consent, deletion behavior, or whether findings from different users and projects may be combined. If the hosting Agent supports persistent or shared memory, review content could therefore affect unrelated future sessions.

The instruction also conflicts with the Skill’s documented output structure by requiring aggregated content to be inserted at the beginning of responses after 20 reviews.

Attack Path

1. The Skill is loaded by an Agent that supports persistent or shared memory.
2. After each Dockerfile review, the Agent records the “most impactful finding.”
3. Findings accumulate across separate reviews and potentially across unrelated projects or users.
4. After 20 reviews, the stored information is used to alter later responses by adding a “Top 3 Dockerfile mistakes” section.
5. If retained findings contain project-specific or attacker-influenced content, that content may influence subsequent reports outside its original context.

This path depends on the host Agent providing persistent memory; the Markdown file itself does not implement storage.

Impact Assessment

The instruction does not obtain operating-system privileges, execute code, access credentials, o ...[truncated 444 chars]

Remediation

View remediation

Remediation Suggestions

Remove the self-improvement section because historical aggregation is not required to review the current Docker configuration.

If review analytics are intentionally supported:

1. Make collection explicit and opt-in.
2. Restrict retained data to the current conversation or an identified user-controlled workspace.
3. Do not store Dockerfile contents, secrets, project identifiers, or other sensitive material.
4. Define retention periods and provide deletion controls.
5. Prevent information from one user or project from influencing another.
6. Keep analytics separate from the required report format.
7. Generate any “Top 3” summary only from data supplied within the current authorized context.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

- Running as `root` (no `USER` directive) — container escape risk
- Secret or credential in `ENV`, `ARG`, or `RUN` layer — visible in image history
- Base image not pinned (`FROM ubuntu:latest` instead of `ubuntu:22.04`) — supply chain risk
- Using `curl | bash` to install software — arbitrary code execution
- Unnecessary packages installed (attack surface)
- No `HEALTHCHECK` — orchestrator can't detect unhealthy containers
- Writable filesystem where read-only would suffice

Static analysis

No suspicious patterns detected.