Security audit

Docker基础工具专业版

Security checks across malware telemetry and agentic risk

Overview

This Docker operations skill is not covertly malicious, but it gives an agent broad Docker control and includes unscoped destructive examples that could disrupt containers or expose secrets.

Review before installing. Use only in Docker environments where the agent is allowed to administer containers, and require explicit confirmation for stop, prune, service removal, stack removal, registry push, and deployment actions. Avoid running it against production or shared hosts until commands are scoped to named projects or containers and secret output is masked.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 79% confidence
Finding: The document claims only whitelist commands are executed and user input is not concatenated into command lines, yet multiple command examples contain dynamic placeholders and operational command execution via exec. In an agent skill that can read, write, and execute commands, this mismatch can cause unsafe implementation assumptions and lead to command injection or unintended shell execution if dynamic fields are later sourced from user input.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger condition is overly broad ('use when improving efficiency, automation, batch processing, workflow optimization'), which can cause the skill to activate for many unrelated requests. In a skill with exec and write capabilities plus destructive Docker operations, over-triggering materially increases the chance of accidental execution of high-impact infrastructure commands in the wrong context.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill includes batch commands that stop all containers and prune containers, images, volumes, and networks, but it does not present strong warnings, safeguards, or confirmation requirements. In an enterprise Docker operations context, these commands can immediately disrupt services, destroy state, and remove assets across a host if triggered mistakenly or with insufficient review.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The Swarm examples include service removal, rollback, stack deployment, and stack removal without clear risk disclosures or confirmation guidance. While these are legitimate admin operations, in a multi-node production orchestration context they can cause service interruption or deletion if executed unintentionally.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The example prints all environment variables and then searches for secret-like names, which can expose passwords, tokens, or keys directly in logs or terminal history. In a security-scan context this is especially risky because users may run it on production images and share the output for troubleshooting.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.