Security audit

Docker V1迁移专业版

Security checks across malware telemetry and agentic risk

Overview

This Docker migration skill appears legitimate, but it asks for broad file-changing and command-running authority with trigger wording that could apply it outside Docker migrations.

Review before installing and use only for Docker migration work. Run it in a version-controlled repository or disposable copy, inspect every generated shell command before execution, keep backups containing .env files out of version control, and avoid letting it handle generic document conversion or unrelated file-processing tasks.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The trigger-condition text says the skill should be used for generic file processing, document conversion, format conversion, and content extraction, which is much broader than a Docker V1-to-V2 migration tool. In an agent ecosystem, overly broad routing can cause this skill to be invoked on unrelated tasks, where its available read/exec/write tools increase the chance of unintended file modification or command execution on user systems.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The manifest advertises API integration as a core capability even though the documented purpose is local Docker migration. Unjustified claims of external-service usage can lead operators or orchestrators to permit broader networked behavior than necessary, expanding attack surface and creating opportunities for unexpected data egress or dependency on unvetted endpoints.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger conditions are overly broad and mismatched to the skill’s stated Docker-specific scope, encouraging invocation for generic file and conversion tasks. Because the skill exposes read, write, and exec capabilities and includes migration scripts that modify files and run shell commands, misrouting can cause high-impact unintended actions on arbitrary repositories or hosts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill quickly transitions into file-modifying and command-executing behavior without a clear upfront warning that it may rewrite Dockerfiles, CI/CD configs, and other project files or run shell commands. This weakens informed consent and increases the risk that users invoke destructive or environment-altering operations without understanding system impact or backup requirements.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The markdown provides copy-pastable scripts that recursively back up and overwrite project files, including .env* files, without prominent warnings or safety checks. In a developer skill context, this can lead to accidental destruction of configuration, restoration of stale files, or unintended copying of secrets into backup directories that may later be committed, exposed, or mishandled.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.