docker-container-rerun-all

• Outcome: Pass
• Latest audit: Oct 15, 2026 · 6:36 PM UTC
• Version: 1.2.0

Overview

This skill is a disclosed Docker batch-check/update helper; it is powerful and should be used carefully, but I did not find hidden, deceptive, or purpose-mismatched behavior.

Install this only if you want an agent to read your Docker recreate-command memory and run Docker maintenance commands. Run the default non-apply mode first, inspect every remembered docker run command, and use --apply only when you are comfortable with containers being stopped, removed, and recreated. Pay special attention to commands using docker.sock, privileged mounts, host paths, or mutable image tags such as latest.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

A description-behavior mismatch is dangerous because operators may approve the skill believing it only touches remembered containers from MEMORY.md, while the implemented behavior may enumerate all local containers, follow additional paths, and produce different outputs. That expands the trust boundary and can lead to unintended Docker actions, including checks or recreations against containers the user did not intend to manage.

Content

No source excerpt is available for this finding.

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The documented recreate command includes mounting /var/run/docker.sock into a container, which grants that container effective control over the host Docker daemon. If such a remembered command is later reused by this skill in apply mode, a compromised or unsafe container image can manipulate other containers or the host, making this highly sensitive in a batch-update workflow.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

-e AUTOHEAL_INTERVAL=30
-e AUTOHEAL_START_PERIOD=300
-e CURL_TIMEOUT=30
-v /var/run/docker.sock:/var/run/docker.sock
willfarrell/autoheal:latest

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill directs use of file reads and shell execution against Docker but does not declare any tool scope or permission boundaries. In an agent setting, undeclared capabilities make it easier for the skill to trigger filesystem access and container-management commands without clear operator review, increasing the chance of over-broad or unsafe execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions require results to be reported with polished Chinese wording, prefer a Telegram-friendly Chinese summary, and use a detailed Chinese report by default. This imposes a specific language/locale on users without offering a choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_all_docker_reruns.py (reported line 17)May include surrounding context.

python

def list_container_names():
    try:
        out = subprocess.check_output(['docker', 'ps', '-a', '--format', '{{.Names}}'], text=True)
        return [line.strip() for line in out.splitlines() if line.strip()]
    except Exception:
        return []

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_all_docker_reruns.py (reported line 95)May include surrounding context.

python

def run_one(container_name: str, recreate_command: str, apply: bool):
    cmd = ['python3', str(SINGLE_SCRIPT), '--container-name', container_name, '--recreate-command', recreate_command]
    if apply: cmd.append('--apply')
    proc = subprocess.run(cmd, text=True, capture_output=True)
    if proc.returncode != 0:
        return {'container_name': container_name, 'ok': False, 'error': (proc.stderr or proc.stdout).strip()}
    stdout = (proc.stdout or '').strip()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script can batch invoke container update/recreation logic for all remembered Docker containers when run with --apply, but it provides no explicit interactive confirmation, allowlist scoping, or dry-run-first guardrail in this file. In the skill context, this is more dangerous because it dynamically sources recreate commands from memory files, so a mistaken or tampered memory entry could trigger broad service disruption or unintended container changes across multiple workloads.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document says 'This skill has two explicit dependencies' and lists a sibling skill plus MEMORY.md. But elsewhere it says the skill may dynamically follow modular memory files referenced from MEMORY.md, meaning the effective file dependency is broader than the dependency statement implies.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The non-apply behavior section says the script 'reads MEMORY.md' and discovers containers dynamically, which suggests a single-file read scope. Earlier documentation states it may also follow modular memory files referenced from MEMORY.md, expanding its actual read surface beyond the simpler description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file includes Chinese-only comments and user-facing report strings such as the output built in build_report, with no opt-in or alternative locale. Under the policy criteria, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.