ClawHub
Back to skill

Security audit

Docker Osx

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it starts a high-trust macOS VM container with risky network exposure and weak supply-chain controls.

Install only on a dedicated, trusted Linux host where Docker/KVM use is acceptable. Prefer a reviewed and pinned Docker-OSX image digest, bind SSH/VNC to localhost or firewall them tightly, change or disable the default password, avoid the `curl | sh` Docker install shortcut, and treat `stop macos` as removing the container rather than merely pausing it.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installation Script Piped Directly to a Shell

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/docker_osx.py:11
Finding

Mutable Third-Party Container Image Executed with KVM Device Access

Content
View full analysis
Remediation
View remediation
" ``` - Record the corresponding upstream version and provenance in `SKILL.md`. - Establish an explicit update procedure in which each new image digest is reviewed and tested before release. - Use image-signature or provenance verification, such as Sigstore/Cosign, where supported. - Run the container with the smallest feasible capability set and retain only the KVM device access necessary for virtualization. - Apply Docker daemon, kernel, KVM, and container-runtime security updates promptly. - Consider enforcing an image allowlist or admission policy so a mutable tag cannot silently replace the approved artifact. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/docker_osx.py:50
Finding

SSH and VNC Exposed on All Interfaces with a Documented Default Password

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

This skill is specifically designed to start a macOS VM and therefore intentionally grants the container access to /dev/kvm, a privileged host device, while also pulling and running a third-party image. In an automated agent context, exposing hardware virtualization to a container significantly raises the blast radius of a compromised or malicious image and can weaken host isolation.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 28)May include surrounding context.

python
if not check_kvm():
        return {
            'success': False,
            'error': 'KVM not available. This server does not support hardware virtualization (--device /dev/kvm required).'
        }
    
    if not check_docker():

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documents shell-capable operations (start, stop, ssh, logs) but does not declare any tool scope or allowed-tools boundary. That omission weakens enforcement and review, making it easier for an agent to invoke shell actions beyond what users expect, especially in a high-privilege context involving Docker and KVM.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation exposes a default SSH password (alpine) for a reachable service on port 50922 without any warning or requirement to rotate it. In a Docker/KVM-based macOS VM workflow, this creates a straightforward credential exposure path that can enable unauthorized access if the port is accessible locally, remotely, or through port forwarding.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 20)May include surrounding context.

python
def check_docker():
    """Check if Docker is installed"""
    result = subprocess.run(['docker', '--version'], capture_output=True)
    return result.returncode == 0

def start_macos():

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 38)May include surrounding context.

python
}
    
    # Check if already running
    result = subprocess.run(['docker', 'ps', '--filter', f'name={CONTAINER_NAME}', '--format', '{{.ID}}'], 
                          capture_output=True, text=True)
    if result.stdout.strip():
        return {

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 47)May include surrounding context.

python
}
    
    # Remove old container if exists
    subprocess.run(['docker', 'rm', '-f', CONTAINER_NAME], capture_output=True)
    
    # Start container
    result = subprocess.run([

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

Although the subprocess usage itself is safe from shell injection, this call launches a Docker container with direct access to /dev/kvm and exposes SSH and VNC services on the host. In the context of an agent skill that starts infrastructure automatically, this materially increases attack surface and grants a highly sensitive device to an unpinned third-party image.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 50)May include surrounding context.

python
subprocess.run(['docker', 'rm', '-f', CONTAINER_NAME], capture_output=True)
    
    # Start container
    result = subprocess.run([
        'docker', 'run', '-d',
        '--device', '/dev/kvm',
        '-p', '50922:10022',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The stop action unconditionally removes the container after stopping it, but the user-facing interface describes this as a simple stop operation. In this skill context, that can cause unexpected data loss or loss of build artifacts, which is especially risky for users relying on the VM for iOS development work.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 76)May include surrounding context.

python
def stop_macos():
    """Stop macOS container"""
    result = subprocess.run(['docker', 'stop', CONTAINER_NAME], capture_output=True, text=True)
    subprocess.run(['docker', 'rm', CONTAINER_NAME], capture_output=True)
    
    return {

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 77)May include surrounding context.

python
def stop_macos():
    """Stop macOS container"""
    result = subprocess.run(['docker', 'stop', CONTAINER_NAME], capture_output=True, text=True)
    subprocess.run(['docker', 'rm', CONTAINER_NAME], capture_output=True)
    
    return {
        'success': True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 86)May include surrounding context.

python
def status_macos():
    """Check macOS status"""
    result = subprocess.run([
        'docker', 'ps', '--filter', f'name={CONTAINER_NAME}', 
        '--format', '{{.Status}}|{{.Ports}}'
    ], capture_output=True, text=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 114)May include surrounding context.

python
def logs_macos():
    """Get macOS logs"""
    result = subprocess.run(['docker', 'logs', '-f', '--tail', '50', CONTAINER_NAME], 
                          capture_output=True, text=True, timeout=30)
    return {
        'success': True,

External Script Fetching

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The skill recommends curl -sSL get.docker.com | sh, which fetches and executes a remote script without verification. If the remote host, transport, DNS, or distribution path is compromised, users may execute attacker-controlled code directly on the host system.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
| Error | Fix |
|-------|-----|
| KVM not available | Server needs hardware virtualization |
| Docker not installed | `curl -sSL get.docker.com | sh` |

## Resources

External Script Fetching

Low
Category
Supply Chain
Confidence
86% confidence
Finding

The code returns an installation instruction that pipes a remote script directly into a shell. Even though it is not executed automatically by this script, suggesting this pattern encourages insecure operator behavior and could lead to arbitrary code execution if the remote source is compromised or intercepted.

Content

Scanner excerpt · scripts/docker_osx.py (reported line 34)May include surrounding context.

python
if not check_docker():
        return {
            'success': False,
            'error': 'Docker not installed. Install with: curl -sSL get.docker.com | sh'
        }
    
    # Check if already running

Static analysis

No suspicious patterns detected.