Phy Dockerfile Audit

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:26 PM UTC
• Version: 1.0.3

Overview

This is a coherent local Dockerfile scanner, but one remediation example gives flawed checksum-verification advice users should not copy as written.

Reasonable to install for local Dockerfile auditing. Treat findings as advisory, review output before acting on it, and do not copy the remote ADD checksum remediation verbatim; download to a file, compare against a pinned trusted digest with a valid sha256sum manifest, and fail the build on mismatch.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/dockerfile_audit.py:243

Finding

Invalid checksum verification guidance for remote Docker build artifacts

Content

View full analysis

| sha256sum -c instead. ``` ```python fix="Use RUN curl -fsSL | sha256sum -c instead, or use COPY with a pre-downloaded file.", ``` ### Technical Analysis The Skill identifies remote `ADD` instructions as insecure but recommends piping downloaded content directly into `sha256sum -c`. This is not a valid method of comparing arbitrary downloaded bytes against an expected digest. The `sha256sum -c` option consumes a checksum manifest in a format such as: ```text /tmp/downloaded-file ``` It does not accept downloaded file contents through standard input followed by an expected hash as a positional argument. Consequently, the documented commands generally fail or interpret the input and arguments incorrectly rather than performing the promised integrity check. The issue appears both in the documentation’s pass criteria and in the remediation generated by the scanner. This can give users false confidence that a remote artifact is being securely verified. The Skill itself does not make network requests or execute these commands; the exposure arises when users copy the generated remediation into a Dockerfile or CI workflow. ### Attack Path 1. A project obtains an executable, installer, archive, or other build artifact from a remote URL. 2. The auditor reports the remote `ADD` instruction and recommends the affected `curl | sha256sum -c` command. 3. A user copies or adapts that remediation under the assumption that it validates the artifact against a trusted digest. 4. The remote hosting account, distribution endpoint, DNS path, or ...[truncated 1350 chars]

Remediation

View remediation

/tmp/file" | sha256sum -c -; \ install /tmp/file /desired/path; \ rm -f /tmp/file ``` Apply the following hardening measures: 1. Replace the invalid examples at `SKILL.md:79` and `SKILL.md:168`. 2. Replace the generated remediation at `scripts/dockerfile_audit.py:243`. 3. Ensure the expected digest is obtained through a separate trusted channel and pinned in source control. 4. Never download an expected checksum from the same unauthenticated or mutable source and treat it as independent verification. 5. Use `&&` or `set -e` so artifact installation and execution cannot continue after a failed verification. 6. Prefer `COPY` of a separately verified local artifact when practical. 7. Consider recommending signed releases or provenance verification, such as Sigstore, where supported. 8. Add automated tests confirming that a matching artifact passes and a modified artifact causes a nonzero build result. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

| DF003 | **CRITICAL** | Secret in ENV | CWE-312 | `ENV PASSWORD=...` — baked into image layer |
| DF004 | HIGH | ADD with remote URL | CWE-494 | `ADD https://...` — no integrity check |
| DF005 | MEDIUM | Shell form ENTRYPOINT/CMD | CWE-755 | Signal handling failure — PID 1 won't get SIGTERM |
| DF006 | HIGH | sudo installed | CWE-250 | `apt-get install sudo` — privilege escalation |
| DF007 | MEDIUM | Missing .dockerignore | CWE-552 | `.env`, `.git`, `node_modules` sent to build context |
| DF008 | MEDIUM | Privileged port exposed | CWE-284 | `EXPOSE < 1024` requires root or CAP_NET_BIND_SERVICE |
| DF009 | LOW | apt-get bloat | CWE-1395 | Missing `--no-install-recommends` |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

### DF004 — ADD with remote URL
- **FAIL (HIGH)**: `ADD https://get.example.com/install.sh /tmp/install.sh` — fetched at build time with no hash verification.
- **PASS**: `COPY local_file.sh /tmp/` or `RUN curl -fsSL https://... | sha256sum --check`.

### DF005 — Shell form ENTRYPOINT/CMD
- **FAIL (MEDIUM)**: `ENTRYPOINT service nginx start`, `CMD python app.py` (no brackets).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

run: python3 scripts/dockerfile_audit.py . --format github --ci

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

run: python3 scripts/dockerfile_audit.py . --format github --ci

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md

🟠 [DF004] HIGH — ADD with remote URL (arbitrary fetch) (CWE-494)
   File : ./Dockerfile:6
   Code : ADD https://example.com/script.sh /setup.sh
   Fix  : Use RUN curl -fsSL <url> | sha256sum -c <hash> instead.

🟡 [DF005] MEDIUM — Shell form ENTRYPOINT / CMD (no signal pass) (CWE-755)
   File : ./Dockerfile:7

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 243)May include surrounding context.

python

🟠 [DF004] HIGH — ADD with remote URL (arbitrary fetch) (CWE-494)
   File : ./Dockerfile:6
   Code : ADD https://example.com/script.sh /setup.sh
   Fix  : Use RUN curl -fsSL <url> | sha256sum -c <hash> instead.

🟡 [DF005] MEDIUM — Shell form ENTRYPOINT / CMD (no signal pass) (CWE-755)
   File : ./Dockerfile:7

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 344)May include surrounding context.

python

message="apt-get install without --no-install-recommends — installs unnecessary packages, bloats image",
            file=file, line=ln,
            snippet=inst[:120],
            fix="Use: apt-get install -y --no-install-recommends <packages> && rm -rf /var/lib/apt/lists/*",
        ))
    return findings

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 344)May include surrounding context.

python

message="apt-get install without --no-install-recommends — installs unnecessary packages, bloats image",
            file=file, line=ln,
            snippet=inst[:120],
            fix="Use: apt-get install -y --no-install-recommends <packages> && rm -rf /var/lib/apt/lists/*",
        ))
    return findings

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 344)May include surrounding context.

python

message="apt-get install without --no-install-recommends — installs unnecessary packages, bloats image",
            file=file, line=ln,
            snippet=inst[:120],
            fix="Use: apt-get install -y --no-install-recommends <packages> && rm -rf /var/lib/apt/lists/*",
        ))
    return findings

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 344)May include surrounding context.

python

message="apt-get install without --no-install-recommends — installs unnecessary packages, bloats image",
            file=file, line=ln,
            snippet=inst[:120],
            fix="Use: apt-get install -y --no-install-recommends <packages> && rm -rf /var/lib/apt/lists/*",
        ))
    return findings

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill instructs users to run a local Python script against arbitrary paths and project trees, which implies file-read and shell-execution capability, but the manifest declares no explicit tool scope or permissions. This creates an authorization and transparency gap: consumers and platforms cannot easily constrain or review what the skill is allowed to access before use.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 24)May include surrounding context.

python

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 73)May include surrounding context.

python

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 269)May include surrounding context.

python

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 279)May include surrounding context.

python

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/dockerfile_audit.py (reported line 282)May include surrounding context.

python

---
name: Dockerfile Audit
description: Dockerfile static security auditor. Scans any Dockerfile for 10 security issues — running as root, unpinned base images, secrets in ENV/ARG, remote ADD fetch, shell-form ENTRYPOINT, sudo installed, missing .dockerignore, privileged port EXPOSE, apt-get without --no-install-recommends, and hardcoded ARG defaults. Zero external dependencies (no hadolint, no Docker daemon, no network). Maps to CIS Docker Benchmark and CWE. CI fail-gate included.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

### DF009 — apt-get without --no-install-recommends
- **FAIL (LOW)**: `RUN apt-get install -y curl` (no flag).
- **PASS**: `RUN apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*`.
- **Impact**: `--no-install-recommends` typically reduces image size by 20-40%.

### DF010 — Secret ARG with hardcoded default

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

### DF009 — apt-get without --no-install-recommends
- **FAIL (LOW)**: `RUN apt-get install -y curl` (no flag).
- **PASS**: `RUN apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*`.
- **Impact**: `--no-install-recommends` typically reduces image size by 20-40%.

### DF010 — Secret ARG with hardcoded default

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

### DF009 — apt-get without --no-install-recommends
- **FAIL (LOW)**: `RUN apt-get install -y curl` (no flag).
- **PASS**: `RUN apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*`.
- **Impact**: `--no-install-recommends` typically reduces image size by 20-40%.

### DF010 — Secret ARG with hardcoded default

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:152