容器检查入门工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.3

Overview

This container-inspection skill is mostly aligned with its stated purpose, but its setup and scope create avoidable security risk.

Review before installing. Remove the pip install subprocess step, run only with least-privileged Podman/Docker access, and avoid exposing raw logs, environment variables, mounts, or inspect output unless you are prepared for secrets to appear.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:111

Finding

Unnecessary and Unpinned Installation of a Third-Party Package Named subprocess

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 111
Vulnerability Type: Insecure third-party dependency installation
Risk Level: High

Vulnerable Code

bash

pip install subprocess

Technical Analysis

The Skill instructs users to install a package named subprocess from the configured Python Package Index without specifying a version, package hash, publisher, or trusted source.

Python already provides subprocess as part of its standard library, so no external package is required. Executing this command may instead retrieve an unrelated third-party distribution with the same name. Because Python packages can execute code during build or installation, a malicious or compromised distribution could run arbitrary code under the privileges of the user following the setup instructions.

The absence of version pinning and integrity verification also makes the effective installation artifact mutable over time. The audit did not establish that the referenced package is malicious; the vulnerability is the unnecessary and unsafe dependency acquisition mechanism.

Attack Path

1. An attacker publishes, compromises, or otherwise controls a distribution resolved by pip install subprocess, or influences the user's configured package index.
2. A user follows the environment preparation instructions in SKILL.md.
3. Pip downloads the attacker-controlled source distribution or wheel without checking a project-provided version constraint or cryptographic hash.
4. Installation or build logic executes with the invoking user's privileges.
5. The malicious package can access resources available to that user, including local files, environment variables, credentials, and container-engine interfaces.
6. If the user has access to a privileged Docker or Podman socket, the package may potentially use that existing access to affect containers or the host.

Impact Assessment

Successful exploitation permits arbitrary code execution with the ...[truncated 772 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the following instruction entirely:

   bash

   pip install subprocess
   

2. Import and use Python's standard-library module directly:

   python

   import subprocess
   

3. If genuine third-party dependencies are added later, declare them in a reviewed dependency manifest or lock file.

4. Pin every external dependency to an approved version and verify package integrity with cryptographic hashes, for example by using a hash-locked requirements file and:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

5. Use an explicitly trusted package index and prevent unintended fallback to untrusted or internal indexes.

6. Review package ownership, release history, and provenance before approving new dependencies.

7. Perform installation in an isolated virtual environment as an unprivileged user. Do not install project dependencies as root or an administrator.

8. Avoid exposing Docker or Podman sockets, credentials, or other sensitive resources to dependency installation processes unless strictly necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description contains broad, conflicting trigger language that could cause an agent to invoke this exec-capable skill for unrelated tasks. In context, that matters because the skill is allowed to use command execution and inspect container state, so misrouting can expose sensitive operational data or trigger unsafe command paths in environments where the skill should never have been selected.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The capability scope uses vague keyword-based activation criteria without meaningful boundaries, increasing the chance that an agent will select this skill outside its intended domain. Because the skill has exec access and references operational/container inspection actions, overbroad activation raises the risk of unnecessary command execution and exposure of container metadata or logs.

Content

No source excerpt is available for this finding.

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documented use of the Docker socket is a high-risk privilege boundary because access to /var/run/docker.sock effectively grants root-equivalent control over the host through the container engine. In this skill context, even though the stated purpose is inspection, exposing or using the socket from an exec-capable agent materially increases the danger of host takeover, container breakout operations, secret extraction, and filesystem access if the implementation is permissive or misused.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

engine: "auto"                 # auto | podman | docker
  socket:
    podman: "unix:///run/podman/podman.sock"
    docker: "unix:///var/run/docker.sock"

  defaults:
    log_tail: 100

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description says to use the skill for '数据分析、报表生成、统计洞察、数据可视化', but the rest of the file documents a local Podman/Docker inspection CLI for container status, logs, stats, and config checks. Those broader analytics/reporting/visualization claims are not reflected in the documented operations and overstate the skill's behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description explicitly states '支持中文交互' and the file is written to assume Chinese interaction, but it does not indicate that language is optional or user-selectable. That can conflict with language/locale policy expectations when no opt-in or region-specific justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages inspecting container configuration, environment variables, ports, and mounts without warning that these often contain secrets such as API keys, database passwords, tokens, and internal topology. In a container-ops context this is meaningfully dangerous, because logs and inspect output commonly expose sensitive material that could be surfaced directly to the user or model context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L061 states that the core capability supports '创建/查询/导出操作', which includes create operations. Elsewhere the manifest consistently presents this skill as a container inspection/checking tool focused on status, logs, monitoring, and configuration inspection, with no mutation capability described. This is an active contradiction in the documentation about the skill's intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L203 says '免费版仅支持单个容器检查', but the examples explicitly show '查看所有容器的状态' and commands like 'ps --all' at L66-L79 and L136-L137, and the capability table marks status and resource checks as supported without restricting them to one container. This is a direct documentation contradiction about the actual scope of the free tier.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

L261 advises using HTTPS and validating SSL certificates, but the skill is described throughout as operating via local Podman/Docker CLI with '免费版无需API Key' and local engine access. This documentation introduces a contradictory operational model by implying network API communication that is not part of the described tool behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.