ClawHub
Back to skill

Security audit

Docker基础工具免费版

Security checks for vulnerabilities and agentic risk

Overview

This Docker skill is mostly aligned with its purpose, but it gives an agent command-execution authority for destructive Docker cleanup and broad container operations without clear confirmation safeguards.

Review before installing. Use it only for explicit Docker tasks, avoid running cleanup or volume-deleting commands unless you have inspected the affected resources and confirmed backups, replace sample passwords and public port bindings, and prefer pinned trusted images for commands the agent will execute.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:52
Finding

Destructive Docker operations can execute without mandatory confirmation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:143
Finding

Examples expose database services using a hard-coded weak password

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:36
Finding

Mutable container image tags are downloaded and executed without integrity pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (31)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Commands like docker image prune -a, docker-compose down -v, and volume cleanup can irreversibly remove images, volumes, and persisted data. Because this skill is designed for automated execution, failing to highlight data-loss risk or require confirmation can directly cause destructive outcomes on the user's system.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.

.git .gitignore dist .env *.md

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description uses expansive wording that overlaps with ordinary coding and deployment requests, making accidental invocation likely. In an environment where the skill can execute commands, that broad routing materially increases attack surface and the probability of unnecessary privileged actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description states '支持中文交互', and the document consistently presents the skill as Chinese-only without indicating that users may choose another language. This can be a natural-language policy issue because it implies a fixed language/locale behavior rather than user opt-in or a clearly justified regional limitation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill documents destructive cleanup commands such as docker rm -f and docker container prune without warning that they can irreversibly delete containers and associated state. In an agent-driven exec context, omission of deletion warnings and confirmation requirements makes accidental data loss materially more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

Using nginx:latest introduces a mutable supply-chain dependency: the pulled image can change over time, producing non-reproducible behavior and potentially importing newly compromised or incompatible content. In a skill that can drive exec, normalizing latest increases the chance that users run unreviewed images on their hosts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

L248 将“运维部署管理”列为不适用场景，但文档前文大量提供 docker run、端口映射、卷挂载、Compose 启停扩缩容、镜像 push 等典型部署与运行管理操作（如 L37-L54、L95-L109）。这构成了文档内部对技能适用范围的直接矛盾。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger condition is very broad—covering code generation, programming help, debugging, testing, and deployment—so the skill may be invoked for many common developer requests even when Docker execution is unnecessary. Because the skill includes exec, over-selection raises the chance of executing container or system commands in contexts where a safer read-only or non-executing skill should have been used.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
60% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

md
- .:/app
    - node_modules:/app/node_modules
  environment:
    - NODE_ENV=development

services:
  database:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document claims only whitelisted commands are executed, yet it exposes broad exec capability and examples like docker exec ... bash, host diagnostics, and general command execution without specifying enforceable restrictions. This mismatch can mislead users and downstream agents into overtrusting the skill, increasing the risk of arbitrary command execution on the host or inside containers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.