Security audit

Docker沙箱入门工具

Security checks across malware telemetry and agentic risk

Overview

This Docker sandbox skill is not plainly malicious, but it gives a command-executing agent broad and partly inconsistent instructions that users should review before installing.

Install only if you want an agent to run local Docker and shell commands for sandbox testing. Use it in an isolated workspace without secrets, review each command, avoid writable host mounts for untrusted code, and clarify whether any API/network behavior is actually intended before allowing it to process private code or data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The document tells users that all operations run only through the local Docker daemon and require no API key, but elsewhere advertises API integration and HTTPS network communication. That inconsistency can mislead users about whether data may leave the host, causing unsafe trust assumptions around privacy, egress, and sandbox boundaries.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill is presented as a narrowly scoped Docker sandbox, but later sections expand it into generic automation, file handling, API integration, and information retrieval. This scope creep weakens user understanding of what the skill may actually do and can justify unexpected actions beyond sandbox execution, increasing the chance of unsafe invocation or over-privileged behavior.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description says to use this skill for broad categories like code generation, programming help, debugging, and deployment, which overlaps with many ordinary developer requests. Overly broad routing criteria can cause the agent to invoke a command-executing skill in situations that do not need it, unnecessarily expanding the attack surface and exposing local execution paths.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The capability keywords are extremely broad and vague, effectively matching many generic technical prompts without clear constraints. In a skill with exec access, ambiguous trigger phrases increase the risk of accidental or unjustified activation, which can lead to unexpected command execution or handling of sensitive local resources.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill claims file processing that includes write operations, but it does not clearly warn users that data may be modified or persisted. In the context of a tool with exec capability, missing modification warnings can cause users to authorize actions without understanding the risk of overwriting files, introducing malicious content, or altering project state.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises external API integration but does not provide a clear privacy notice about what information may be transmitted externally. Because the same document also frames the tool as local Docker execution, users may wrongly assume their code, prompts, or artifacts stay on-device, creating a real confidentiality risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.