Sovereign Docker Wizard

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:53 PM UTC
• Version: 1.0.0

Overview

This Docker helper is mostly defensive and coherent, but it includes copyable high-impact container escape guidance and a few security-weak production templates users should review before installing.

Install only if you want a Docker-focused assistant and are comfortable reviewing its generated commands before use. Treat exploit demonstrations, docker socket advice, CI workflows, secret handling, and cleanup commands as drafts requiring human review, especially on production hosts or repositories with publishing credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:1019

Finding

Mutable Third-Party CI Action Executes with Repository Runner Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1019-1023
Vulnerability Type: Mutable third-party CI dependency
Risk Level: Medium

Vulnerable Code

yaml

- name: Scan for vulnerabilities
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ghcr.io/${{ github.repository }}:${{ github.sha }}
    exit-code: 1
    severity: CRITICAL,HIGH

Technical Analysis

The generated GitHub Actions workflow references aquasecurity/trivy-action through the mutable master branch rather than an immutable, reviewed commit SHA. The code associated with this reference can change after the Skill and generated workflow have been reviewed.

GitHub Actions execute third-party action code on the workflow runner. Depending on workflow permissions and surrounding steps, that code may be able to read checked-out repository content, inspect the runner environment, modify build artifacts, and use credentials exposed to the job. The surrounding workflow also authenticates to GitHub Container Registry using secrets.GITHUB_TOKEN, increasing the potential consequences if the action or its upstream account is compromised.

This is a supply-chain weakness; the audit did not identify evidence that the current upstream action is malicious.

Attack Path

1. An attacker compromises the upstream repository, maintainer account, or mutable master branch.
2. The attacker adds malicious commands to the action implementation.
3. A repository uses the workflow generated from this Skill and triggers it through a push to main.
4. GitHub resolves aquasecurity/trivy-action@master to the attacker-modified revision.
5. The modified action executes on the repository's CI runner.
6. Subject to the job's configured permissions, the action can access repository files and runner data, tamper with artifacts, or abuse available GitHub token permissions.

Impact Assessment

The immediate execution scope is the GitHub Actions runner and the affected workflo ...[truncated 473 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the action to a reviewed full commit SHA rather than a branch or mutable tag:

   yaml

   - name: Scan for vulnerabilities
     uses: aquasecurity/trivy-action@FULL_REVIEWED_COMMIT_SHA
     with:
       image-ref: ghcr.io/${{ github.repository }}:${{ github.sha }}
       exit-code: 1
       severity: CRITICAL,HIGH
   

2. Record the corresponding release version in a comment so automated dependency tools can identify and update it safely.

3. Define explicit least-privilege workflow permissions. For example:

   yaml

   permissions:
     contents: read
   

   Grant packages: write only to the specific job or step that must publish an image.

4. Separate image publication and vulnerability scanning into jobs with distinct permissions where practical. The scanning job should not receive package-write credentials.

5. Review dependency updates before changing the pinned SHA. Use Dependabot or Renovate to propose controlled updates without restoring mutable references.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:1090

Finding

Remote Build Artifact Is Downloaded Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1090-1099
Vulnerability Type: Unverified remote build dependency
Risk Level: Low

Vulnerable Code

dockerfile

# BAD: ADD has implicit tar extraction and URL fetching -- unexpected behavior
ADD app.tar.gz /app
ADD https://example.com/file.txt /app/

dockerfile

# GOOD: COPY is explicit and predictable
COPY app/ /app/
RUN wget -O /app/file.txt https://example.com/file.txt

Technical Analysis

The guidance correctly identifies that remote ADD has implicit network behavior, but the proposed replacement still retrieves mutable remote content without verifying its identity or integrity. HTTPS protects transport under normal trust assumptions, but it does not ensure that the remote resource remains unchanged between builds.

No immutable content version, cryptographic digest, or signature validation is included. Consequently, compromise of the hosting service, its account, its delivery infrastructure, or a trusted certificate path could cause a build to incorporate attacker-controlled content. Legitimate upstream replacement of the file could also make builds non-reproducible.

The example names the resource file.txt and does not explicitly execute it. Therefore, direct code execution is not established by the audited text. Impact depends on how the resulting file is consumed by the application or later build stages.

Attack Path

1. A generated Dockerfile adopts the recommended wget pattern.
2. The referenced remote resource changes or its hosting infrastructure is compromised.
3. A subsequent image build downloads the altered resource.
4. Because no digest or signature is checked, the build accepts the altered file.
5. The file is included in the resulting image.
6. If later interpreted as configuration, application data, a script, or another executable input, it may alter application behavior or enable code execution with the privileges of the consuming process.

...[truncated 571 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer vendoring reviewed artifacts in the source repository and using COPY, eliminating network retrieval during the build.

2. If remote retrieval is necessary, use a versioned or content-addressed URL and verify a pinned cryptographic digest in the same build step:

   dockerfile

   ARG FILE_SHA256="EXPECTED_REVIEWED_SHA256"
   RUN wget --https-only -O /tmp/file.txt \
         https://trusted.example/releases/v1.2.3/file.txt && \
       echo "${FILE_SHA256}  /tmp/file.txt" | sha256sum -c - && \
       install -m 0644 /tmp/file.txt /app/file.txt && \
       rm -f /tmp/file.txt
   

3. Prefer signature verification when the publisher provides signed release artifacts. Pin the trusted signing key through a separately reviewed mechanism.

4. Fail the build on download or verification errors and avoid fallback behavior that accepts unverified content.

5. Document the artifact's purpose and ensure it is not executed or interpreted with elevated privileges unless strictly necessary.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (49)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 146)May include surrounding context.

md

node_modules
dist
build
.env
.env.*
*.md
docs/

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 327)May include surrounding context.

md

node_modules
dist
build
.env
.env.*
*.md
docs/

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 568)May include surrounding context.

md

node_modules
dist
build
.env
.env.*
*.md
docs/

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.

md

node_modules
dist
build
.env
.env.*
*.md
docs/

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 459)May include surrounding context.

md

node_modules
dist
build
.env
.env.*
*.md
docs/

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 409)May include surrounding context.

md

db_user:
    file: ./secrets/db_user.txt
  db_password:
    file: ./secrets/db_password.txt

networks:
  default:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 784)May include surrounding context.

md

db_user:
    file: ./secrets/db_user.txt
  db_password:
    file: ./secrets/db_password.txt

networks:
  default:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 759)May include surrounding context.

md

db_user:
    file: ./secrets/db_user.txt
  db_password:
    file: ./secrets/db_password.txt

networks:
  default:

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · EXAMPLES.md (reported line 533)May include surrounding context.

md

network_mode: host
    volumes:
      - /:/host
      - /var/run/docker.sock:/var/run/docker.sock
  db:
    image: postgres
    environment:

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · EXAMPLES.md (reported line 603)May include surrounding context.

[CRITICAL] Docker Socket Mounted

• Location: docker-compose.yml, line 11
• Issue: /var/run/docker.sock is mounted into the container. This gives the container full control over the Docker daemon -- it can create, start, stop, and delete any container on the host, including itself.
• Impact: Full host compromise. The container can start a new container with host root filesystem mounted and escape completely.
• Attack:

  bash

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This example includes a concrete curl command that uses the Docker socket to create a container with the host filesystem mounted, which is a ready-to-run host-compromise recipe. Even though it is presented as an attack demonstration, publishing directly executable exploit steps in a general-purpose skill example materially increases misuse risk.

Content

Scanner excerpt · EXAMPLES.md (reported line 608)May include surrounding context.

• Attack:

  bash

  # From inside the container:
  curl --unix-socket /var/run/docker.sock \
    -X POST "http://localhost/containers/create" \
    -H "Content-Type: application/json" \
    -d '{"Image":"alpine","Cmd":["sh"],"HostConfig":{"Binds":["/:/mnt"]}}'
  

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 620)May include surrounding context.

• Location: docker-compose.yml, line 10
• Issue: - /:/host mounts the entire host root filesystem into the container.
• Impact: The container can read and write every file on the host, including /etc/shadow (password hashes), SSH keys, other container data, and system configuration.
• Fix: Remove this volume mount. Mount only the specific directories the application needs:

  yaml

  volumes:
  

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 365)May include surrounding context.

md

.env.*
*.pem
*.key
credentials.json

# Docker
Dockerfile*

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 460)May include surrounding context.

md

.env.*
*.pem
*.key
credentials.json

# Docker
Dockerfile*

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 417)May include surrounding context.

md

1. **Strip binaries:** `RUN strip /app/binary` (saves 30-60% on compiled binaries)
2. **Use `--no-cache-dir` with pip:** Prevents pip from caching downloaded packages
3. **Use `npm ci` instead of `npm install`:** Cleaner, faster, deterministic
4. **Remove documentation:** `RUN rm -rf /usr/share/doc /usr/share/man /usr/share/info`
5. **Multi-stage squash:** Build everything in one stage, copy only artifacts to final
6. **Use `.dockerignore` aggressively:** Smaller build context = faster builds

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 417)May include surrounding context.

md

1. **Strip binaries:** `RUN strip /app/binary` (saves 30-60% on compiled binaries)
2. **Use `--no-cache-dir` with pip:** Prevents pip from caching downloaded packages
3. **Use `npm ci` instead of `npm install`:** Cleaner, faster, deterministic
4. **Remove documentation:** `RUN rm -rf /usr/share/doc /usr/share/man /usr/share/info`
5. **Multi-stage squash:** Build everything in one stage, copy only artifacts to final
6. **Use `.dockerignore` aggressively:** Smaller build context = faster builds

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 417)May include surrounding context.

md

1. **Strip binaries:** `RUN strip /app/binary` (saves 30-60% on compiled binaries)
2. **Use `--no-cache-dir` with pip:** Prevents pip from caching downloaded packages
3. **Use `npm ci` instead of `npm install`:** Cleaner, faster, deterministic
4. **Remove documentation:** `RUN rm -rf /usr/share/doc /usr/share/man /usr/share/info`
5. **Multi-stage squash:** Build everything in one stage, copy only artifacts to final
6. **Use `.dockerignore` aggressively:** Smaller build context = faster builds

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 425)May include surrounding context.

md

## Security Checks

Container security is not optional. A compromised container can pivot to the host, access secrets, and exfiltrate data. Every Dockerfile must pass these checks.

### Critical Security Checks

Privileged Kubernetes Workload

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Content

Scanner excerpt · EXAMPLES.md (reported line 529)May include surrounding context.

Detection in docker-compose:

yaml

# BAD
privileged: true
cap_add:
  - ALL

Privileged Kubernetes Workload

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Content

Scanner excerpt · EXAMPLES.md (reported line 585)May include surrounding context.

Detection in docker-compose:

yaml

# BAD
privileged: true
cap_add:
  - ALL

Privileged Kubernetes Workload

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Content

Scanner excerpt · EXAMPLES.md (reported line 591)May include surrounding context.

Detection in docker-compose:

yaml

# BAD
privileged: true
cap_add:
  - ALL

Privileged Kubernetes Workload

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Content

Scanner excerpt · SKILL.md (reported line 506)May include surrounding context.

Detection in docker-compose:

yaml

# BAD
privileged: true
cap_add:
  - ALL

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The production template allows secrets to be supplied through host environment or '.env', which can lead to sensitive values being exposed in shell history, CI logs, compose files, or mismanaged environment files. In a skill meant to teach production security, this weakens the model and may cause users to deploy with less secure secret handling.

Content

Scanner excerpt · SKILL.md (reported line 660)May include surrounding context.

md

- "3000:3000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL  # Value from host environment or .env
      - REDIS_URL
    deploy:
      replicas: 2

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file includes example user prompts such as "Optimize this Node.js Dockerfile" that describe invocation in a very broad way without any explicit trigger constraints or exclusion conditions. As written, the examples suggest the skill may activate on common optimization requests rather than a narrowly scoped command or context-specific phrase.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The phrase "Security audit this container configuration" is a natural-language invocation example that is broad and does not define what inputs, environments, or contexts are in scope. Without explicit constraints, it could overlap with a wide range of generic audit requests and lead to unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.exposed_secret_literal

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:417

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: EXAMPLES.md:513

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:456