Security audit

Docker Manager

Security checks for vulnerabilities and agentic risk

Overview

This Docker admin skill is coherent, but it can stop, delete, prune, and execute inside containers without built-in confirmation.

Install only where the agent is allowed to administer Docker on your behalf. Confirm exact container, image, and volume targets before using stop, rm, rmi, prune, or exec, and avoid using it against production Docker hosts unless you have backups and a clear rollback plan.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (34)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description understates the skill's effective capabilities relative to the documented behavior, especially around image deletion, pruning, and potentially entering containers. This mismatch can mislead users or policy systems into approving a skill that can perform more destructive or invasive actions than expected.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
python3 scripts/docker_mgr.py ps

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises shell-capable behavior through documented commands but declares no explicit tool scope or permissions boundary. In an agent environment, this can cause the skill to run with broader execution authority than users or orchestrators expect, increasing the risk of unintended destructive Docker operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Broad trigger phrases such as 'Docker' and generic container-management terms may activate the skill during ordinary discussion rather than an intentional admin request. In a skill capable of starting, stopping, or deleting containers/images, accidental invocation raises the chance of unauthorized or unintended operational changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill prominently includes destructive operations like removing containers and images but does not warn users about data loss, service disruption, or irreversibility. In an ops context, missing warnings materially increase the likelihood of accidental destructive use against production workloads.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/docker_mgr.py (reported line 15)May include surrounding context.
python
"""执行docker命令""" if isinstance(cmd, str): cmd = cmd.split() result = subprocess.run(cmd, capture_output=capture, text=True) if result.returncode != 0: print(f"❌ 执行失败: {result.stderr.strip()}") return None

Static analysis

No suspicious patterns detected.