Security audit

Docker沙箱环境工具

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to manage Docker sandboxes, but its broad and mismatched instructions could cause agents to run powerful commands or expose project files in more situations than users expect.

Install only if you specifically want an agent to create and operate Docker sandbox environments. Treat it as Review-worthy: use a temporary or read-only workspace for untrusted code, avoid mounting sensitive project directories, review commands before execution, and do not rely on the advertised security scanning or API features unless the publisher provides concrete implementation details.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest mixes unrelated scopes: Docker sandbox management and database/SQL/data-storage operations. This kind of scope inflation can cause an agent to invoke the skill in contexts far beyond its actual safety model, increasing the chance of unintended command execution or misuse under false assumptions about what the tool is meant to do.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documentation advertises security scanning, threat intelligence, and zero-day protection features that are not substantiated by the rest of the skill. Overclaiming defensive capability is dangerous because users or agents may rely on nonexistent protections and run risky workloads with misplaced trust.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The file switches from sandbox-management behavior to generic content-processing inputs and JSON response schemas, indicating templated or mismatched documentation. This can mislead an agent about expected inputs/outputs, causing unsafe automation decisions or accidental execution in unintended workflows.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: Claiming API integration and information retrieval capabilities beyond the stated purpose expands the apparent authority of the skill without clear boundaries. That broader perceived scope can trigger the skill in unnecessary contexts and increase the blast radius of mistakes or misuse.

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: The skill emphasizes safety and sandboxing while also stating that the current project directory is mounted into the sandbox via virtiofs. That weakens isolation materially: code run inside the sandbox may read, modify, or destroy host project files, so describing the environment as simply 'safe' is misleading.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation language is broad enough to match many common development and data tasks, which can cause over-triggering. In a skill with exec capability, overbroad invocation criteria are risky because they increase the odds that an agent will run shell-capable tooling in situations where it is unnecessary or poorly scoped.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The instructions tell users to mount the current directory into the sandbox without clearly warning that host files may be exposed to read/write access. In the context of running untrusted code, this is especially dangerous because the mounted workspace becomes part of the attack surface despite the 'sandbox' framing.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The examples run package installation and shell commands in the sandbox without clearly disclosing network access, dependency side effects, or changes inside the environment. Given the presence of exec tooling and mention of allowlisted networking, users may underestimate that commands can fetch untrusted code or alter mounted data.

Static analysis

No suspicious patterns detected.