Security audit

Docker Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This Docker skill mostly matches its stated purpose, but its trigger text is overbroad and it advertises disruptive Docker actions without enough user-control guidance.

Review this skill before installing. Use it only for deliberate Docker/container-management tasks on environments you are comfortable modifying, and do not rely on its analytics/reporting trigger text. Confirm destructive actions such as deleting images, stopping containers, removing resources, or running compose down before allowing an agent to execute them, especially on shared or production-like Docker hosts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest description mixes unrelated data-analysis/reporting/visualization triggers into a Docker-management skill, which can cause the agent to invoke a high-privilege toolset (`exec`, `write`, Docker operations) for requests outside its actual scope. This scope confusion increases the chance of unsafe execution, unintended file/container modifications, and user deception about what the skill is meant to do.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The capability-coverage statement explicitly claims support for analytics-related keywords that do not match the implemented Docker functionality. Keyword overclaiming can steer an agent to select this skill for unrelated prompts, exposing dangerous container and execution capabilities in contexts where they are unnecessary and potentially harmful.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The description contains broad, contradictory invocation cues unrelated to Docker, making the activation scope ambiguous. In an agent environment, ambiguous triggers are dangerous because they can cause over-selection of a skill that has execution and system-modifying capabilities, leading to unintended actions on local or remote Docker environments.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The capability coverage relies on broad keyword-based activation without meaningful constraints, which can cause the skill to match many unrelated prompts. Because this skill advertises `exec` and Docker control, overbroad activation materially raises the risk of unnecessary privileged operations and accidental misuse.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation includes destructive operations such as deleting images, stopping/removing containers, and tearing down compose environments without prominent warnings, confirmations, or safety guidance. In Docker contexts, these actions can cause service disruption, data loss, or irreversible deletion of local resources, especially when volumes or production-like environments are involved.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.