Security audit
Security checks for vulnerabilities and agentic risk
This Docker sandbox skill is not clearly malicious, but it asks for command and file authority while its documentation is broad, inconsistent, and under-discloses workspace exposure risks.
Install only if you specifically want an agent to manage Docker sandbox commands. Use minimal or read-only mounts when possible, avoid mounting repositories with secrets, review package installs before running them, and do not rely on the advertised scanning or threat-intelligence claims unless separately verified.
The skill metadata and description mix Docker sandbox management with unrelated database and SQL use cases, creating a misleading capability surface. This can cause the agent to invoke the skill in contexts far outside its intended trust boundary, increasing the chance of inappropriate command execution or unsafe data handling under the guise of a sandbox tool.
The activation guidance is extremely broad, covering common development, debugging, deployment, and database tasks. Because the skill exposes read/exec/write tooling, vague routing criteria can cause over-invocation in many ordinary requests, expanding the opportunity for unnecessary command execution and access to local project data.
The documentation advertises advanced security functions such as CVE correlation, threat intelligence, and zero-day protection that do not align with the stated sandbox-management role. Overstated security claims can mislead users and agents into relying on protections that may not exist, resulting in risky trust decisions and underestimation of real exposure.
The example mounts the current directory into the sandbox without a prominent warning that all project files may become accessible to code running inside that environment. In a skill intended to execute untrusted code, this is especially dangerous because the sandbox may limit host escape while still exposing sensitive source code, secrets, and configuration through the mounted workspace.
The examples show executing commands and globally installing packages inside the sandbox without a nearby warning about side effects, supply-chain risk, and possible modification of the mounted workspace. Given this skill's purpose of running potentially untrusted code, package installation and shell execution materially increase the chance of malicious scripts changing files, exfiltrating data, or creating persistence within accessible paths.
The parameter and response sections describe a generic content-processing interface rather than a Docker sandbox control interface. This mismatch obscures what inputs are actually accepted and what operations may occur, making it easier for agents or users to invoke the skill under false assumptions and harder to apply least-privilege review.
The inline capability list expands the skill into broad file handling, external API integration, and information retrieval, contradicting the declared Docker sandbox purpose. This broadens perceived authority and may cause an agent to route sensitive operations through a skill that also has exec/write capabilities, increasing misuse risk.
No suspicious patterns detected.
