Docker沙箱入门工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.3

Overview

This Docker sandbox skill is not clearly malicious, but its broad triggers and mixed network/API guidance make its high-impact Docker and command-execution access under-scoped.

Install only if you intend to use it for local Docker sandbox work and are comfortable granting the agent command execution and Docker access. Prefer pinning the docker Python dependency, running in a low-privilege environment, and manually confirming network mode and mounted volumes before executing untrusted code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:130

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 130–134 and 226–232
Vulnerability Type: Unpinned dependency installation without integrity verification
Risk Level: Medium

Vulnerable Code

bash

# Install Python dependencies
pip install docker

The dependency table repeats the same installation instruction:

markdown

| Dependency | Type | Required | Installation |
|:-----------|:-----|:---------|:-------------|
| docker | Python library | Yes | `pip install docker` |

Technical Analysis

The skill directs users or an executing Agent to install the docker package without specifying an audited version, verifying package hashes, using a lock file, or requiring a trusted package index. Consequently, the package version and its transitive dependency set may change independently of the reviewed skill.

Python package installation may execute package-controlled build or installation logic. If the package, one of its dependencies, the configured package index, or the dependency resolution process is compromised, following this instruction could introduce and execute attacker-controlled code. The audit found no evidence that the named docker package is currently malicious; the vulnerability is the unsafe and non-reproducible dependency installation process.

Attack Path

1. An attacker compromises a future release of the dependency, a transitive dependency, or the package distribution channel available to the target.
2. A user or Agent follows the documented pip install docker instruction.
3. Package resolution retrieves the attacker-controlled or compromised release because no version or hash is enforced.
4. Malicious build, installation, import-time, or runtime code executes in the installation environment.
5. The payload acts with the privileges and environmental access of the user or Agent that invoked pip.

Impact Assessment

Successful exploitation could pro ...[truncated 693 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version rather than installing the latest available release:

   text

   docker==<audited-version>
   

2. Generate a lock file containing cryptographic hashes for the direct dependency and all transitive dependencies.
3. Install with hash enforcement, such as:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Configure and document an approved HTTPS package index. Avoid untrusted mirrors, additional indexes, and ambiguous dependency sources.
5. Perform installation in an isolated virtual environment under a non-privileged account.
6. Audit dependency updates before changing the pinned version, including transitive dependencies and published package provenance.
7. Avoid installing packages from within a context that exposes sensitive credentials or direct Docker daemon access unless strictly required.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation language is so broad that it overlaps with ordinary coding, debugging, deployment, and development-assistance requests. In an agent environment, this can cause over-selection of a high-risk exec-enabled skill for many routine prompts, unnecessarily exposing the system to command execution and Docker interactions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation claims local Docker-only execution and network isolation, yet elsewhere instructs HTTPS external communication and network diagnostics like ping. These conflicting instructions can lead an agent or user to assume stronger isolation than actually enforced, potentially enabling unintended outbound connectivity or misuse of host networking during execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as a narrowly scoped Docker sandbox, but the documented 'core functions' expand into generic file handling, API integration, command execution, and information retrieval. That scope drift can cause an agent to invoke the skill for broader tasks than users expect, increasing the chance of unnecessary command execution or external access under the trusted framing of a 'safe sandbox' tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description states '支持中文交互', and the file’s introductory text also centers the skill on Chinese interaction without indicating that other languages are supported on user request. That creates a locale/language preference in natural language without explicit opt-in or a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The functionality note explicitly highlights '中文交互' but does not mention that the user may choose another language. This can be read as a fixed language behavior, which conflicts with the requirement to avoid forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.