Docker Compose Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:25 AM UTC
• Version: 1.0.1

Overview

The skill is a simple Docker Compose generator, but it silently creates insecure database services and can overwrite user-selected files.

Review this skill before installing. It appears to be a small local generator, not malware, but the generated compose file should not be used on a shared, public, or production host without changing credentials, adding Redis authentication, and limiting port bindings. Also avoid passing arbitrary output paths because the script can overwrite existing files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: docker-compose-generator.sh:10

Finding

Generated Services Use Insecure Credentials and Public Network Exposure

Content

View full analysis

Vulnerability Details

File Location: docker-compose-generator.sh, lines 10–22
Vulnerability Type: Hardcoded credentials and insecure service exposure
Risk Level: High

Vulnerable Code:

yaml

mysql:
  image: mysql:8
  environment:
    MYSQL_ROOT_PASSWORD: root
    MYSQL_DATABASE: app
  ports:
    - "3306:3306"
  volumes:
    - mysql_data:/var/lib/mysql

redis:
  image: redis:7-alpine
  ports:
    - "6379:6379"

Technical Analysis

The generated Docker Compose configuration assigns the predictable value root to the MySQL root password. It also publishes MySQL port 3306 and Redis port 6379 without restricting the host address, which normally binds them to all available host interfaces.

Redis is generated without a password, ACL configuration, or other authentication requirement. Consequently, starting this configuration on a network-accessible host may expose an unauthenticated Redis instance and a MySQL administrative account protected only by a publicly known password.

Attack Path

1. A user runs the generator and starts the resulting Compose stack.
2. Docker publishes ports 3306 and 6379 on the host's available interfaces.
3. An attacker with network access discovers either published port.
4. The attacker connects to MySQL using the known root password root, or connects to Redis without authentication.
5. Subject to the services' network configuration and database state, the attacker can read, alter, or delete stored data and use the privileges exposed by the corresponding database account.

Impact Assessment

Successful exploitation may provide administrative access to the generated MySQL database and unauthenticated access to Redis. The affected scope includes data stored by applications using these services, including its confidentiality, integrity, and availability. Exploitation does not directly grant host operating-system privileges based on the reviewe ...[truncated 85 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the hardcoded MySQL root password.
• Require the password to be supplied through a protected environment file, Docker secret, or external secret-management system.
• Validate that a strong password has been provided and fail securely if it is missing.
• Bind development-only ports to localhost, such as 127.0.0.1:3306:3306 and 127.0.0.1:6379:6379.
• Do not publish database ports unless external access is explicitly requested.
• Configure Redis authentication and ACLs, using a securely generated secret.
• Place services on an internal Docker network and allow access only from containers that require it.
• Document that the generated configuration is intended for local development and must not be deployed unchanged in production.

T09 · Insecure Skill Coding Practices

Warning

• Location: docker-compose-generator.sh:3

Finding

Unrestricted Output Path Allows Overwriting Writable Files

Content

View full analysis

Vulnerability Details

File Location: docker-compose-generator.sh, lines 3–5
Vulnerability Type: Arbitrary file overwrite through an unvalidated output path
Risk Level: Medium

Vulnerable Code:

bash

OUTPUT="${2:-docker-compose.yml}"

cat > "$OUTPUT" << 'YML'

Technical Analysis

The script accepts its second positional argument as an unrestricted output path and opens that path using the shell's truncating redirection operator. If the destination already exists, its prior contents are destroyed before the Compose content is written.

Although quoting "$OUTPUT" prevents shell metacharacters and whitespace from causing command injection, it does not prevent absolute paths, parent-directory traversal, existing-file replacement, or symlink following. The operation executes with the privileges of the invoking user.

Attack Path

1. An attacker influences the second argument passed to the script, or persuades a user or automated process to invoke it with an attacker-selected output path.
2. The selected path identifies an existing writable file, or a symbolic link resolves to such a file.
3. The cat > "$OUTPUT" redirection truncates the destination.
4. The script replaces the previous contents with the fixed Docker Compose document.
5. Affected software may fail or behave incorrectly when it later reads the corrupted configuration or data file.

Exploitation is limited to files writable by the account running the script. If the script is run with elevated privileges, the overwrite scope increases accordingly.

Impact Assessment

An attacker may destroy or replace files writable by the invoking account, causing loss of data, configuration corruption, or denial of service. Under elevated execution, privileged files could also be affected. The written content is fixed rather than attacker-controlled, so this finding does not by itself establish arbitrary code execution.

Remediation

View remediation

Remediation Suggestions

• Restrict output to an explicitly approved directory.
• Reject absolute paths and paths containing traversal components such as ...
• Resolve and validate the canonical parent directory before writing.
• Refuse to follow symbolic links and verify that the destination is a regular file or does not yet exist.
• Refuse to overwrite existing files by default.
• Require an explicit --force option for intentional replacement and display the resolved destination before proceeding.
• Create a temporary file securely in the approved destination directory, set restrictive permissions, and atomically rename it after successful generation.
• Avoid running the generator with elevated privileges.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述为可生成支持多种常用服务（如 MySQL、PostgreSQL、Redis、MongoDB、Elasticsearch）的 Docker Compose 配置，暗示至少具备这些服务的生成能力或可选支持。但代码实际只是把一段固定 YAML 写入输出文件，内容仅包括 MySQL 和 Redis。虽然脚本接收 SERVICES 参数，但该参数完全未被使用，因此不存在按请求选择或生成其他服务的行为。主目的仍与生成 Docker Compose 配置相关，但能力范围明显小于声明，属于描述与实际行为不符。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description and the main skill description are written entirely in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking context. This creates a natural-language locale constraint that is not documented as optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description is written as '生成 Docker Compose 配置', which specifies the skill behavior in Chinese and may imply a fixed language/locale without offering user choice. The policy requires avoiding language-specific constraints unless the skill explicitly provides opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The script writes a docker-compose file to the path in OUTPUT using shell redirection, which can overwrite an existing file. Although it prints a success message afterward, there is no confirmation prompt, pre-write warning, or explanatory comment/docstring disclosing that the target file will be created or replaced.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.