T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:139- Finding
Unverified Remote Installation Script Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Docker Toolkit Free
Security checks for vulnerabilities and agentic risk
Overview
This Docker skill mostly matches its stated purpose, but it mixes in unrelated activation text and recommends high-risk setup and Docker access without enough guardrails.
Install only if you intend to let the agent perform local Docker administration. Avoid using the curl-to-shell installer, prefer official verified Docker installation steps, use an isolated Python environment with pinned dependencies, and require confirmation before stopping, deleting, or changing containers, images, volumes, networks, or Compose services.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:141- Finding
Unpinned Python Dependency Installed from a Mutable Package Source
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Overly broad and mismatched trigger language is dangerous here because the skill has read/write/exec tools and can perform operational Docker actions. If selected for unrelated requests, the agent may execute commands or alter local container resources when the user only intended analysis or reporting assistance.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
Piping curl output directly into sh is a classic command-chaining anti-pattern that enables immediate execution of remote content without inspection. Within a skill that already concerns host/container administration, this compounds risk by encouraging unsafe privileged setup behavior.
- Content
bash # 依赖说明 # macOS: brew install --cask docker # Linux: curl -fsSL https://get.docker.com | sh # Windows: 下载Docker Desktop # ... # 安装Python依赖
Docker Socket Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
Exposing or encouraging direct access to /var/run/docker.sock is highly sensitive because Docker socket access typically grants root-equivalent control over the host through container management APIs. In the context of an agent skill with exec capability, this substantially increases the blast radius of mistakes or misuse.
- Content
yaml docker_config: host: "unix:///var/run/docker.sock" timeout: 60 # ... defaults:
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest description mixes Docker administration with unrelated data-analysis/reporting trigger text, which can cause the agent to invoke this skill in the wrong contexts. Because the skill exposes exec/write capabilities and Docker-management actions, accidental invocation broadens the chance of unintended system-impacting operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation advertises destructive operations such as stop/delete of images and containers without requiring warnings, confirmation, or discussion of service interruption and data-loss risks. In real agent use, this can normalize unsafe execution patterns and lead to accidental disruption of running workloads.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The capability-coverage statement explicitly claims support for data-analysis-related scenarios even though the rest of the skill is for Docker operations. This creates scope confusion that can misroute user requests into a skill capable of executing local commands and modifying container state.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The vague keyword-based activation list lacks meaningful constraints and includes generic or unrelated terms, which increases the probability of unintended invocation. In a skill that can drive container lifecycle and system-level operations, poor scoping materially raises operational risk.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
The documentation recommends fetching and executing a remote installation script directly from the network. This is a supply-chain risk because users may run unreviewed code with elevated privileges, and any compromise of the source or transport can lead to arbitrary code execution.
- Content
bash # 依赖说明 # macOS: brew install --cask docker # Linux: curl -fsSL https://get.docker.com | sh # Windows: 下载Docker Desktop # ... # 安装Python依赖
Static analysis
No suspicious patterns detected.