ClawHub
Back to skill

Security audit

Docker控制管理工具

Security checks across malware telemetry and agentic risk

Overview

This Docker/Podman skill is not clearly malicious, but it asks for command and write access while mixing read-only inspection with broader container management and image-building behavior.

Review before installing. Use this skill only in environments where the agent is allowed to run Podman and modify container-related state. Prefer read-only inspection tasks unless you explicitly approve starts, stops, removals, builds, file writes, or deployment changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest and top-level description frame the skill as inspection-focused, but the body expands scope into active container/image management and image building. That mismatch can cause users or agent orchestrators to grant the skill more trust or autonomy than intended, increasing the chance of unintended state-changing operations through exec/write-capable tooling.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The FAQ states the tool can execute Podman commands for management, which contradicts the narrower inspection-oriented positioning. In a skill with exec and write permissions, this ambiguity is dangerous because downstream agents may invoke it in contexts expecting read-only behavior while it can actually modify containers, images, or host state.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The invocation guidance uses broad trigger language for monitoring, logs, alerts, and deployment management without narrowly scoping safe usage. In combination with exec/write tools, overly broad routing criteria can cause agents to invoke this skill in situations where users did not intend command execution or operational changes.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill advertises file handling, API integration, and command execution but does not clearly warn users that it has exec and write capabilities. In an operations/container context, this is more dangerous because such capabilities can affect host files, container state, credentials, logs, and deployment artifacts, making accidental destructive or sensitive actions more likely.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.