Astra Docker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:43 PM UTC
• Version: 1.0.0

Overview

This Docker workspace skill has a coherent purpose, but it grants broad sudo-backed command and file-write access with injection flaws that can exceed the intended container boundary.

Install only if you intentionally want this agent to control the astra-env Docker container and you trust the runtime environment. Before use, the publisher should remove sudo where possible, replace shell-built commands with structured Docker calls, restrict paths to /workspace, and add clear user confirmation for destructive commands and writes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:21

Finding

Host Command Injection Through docker_exec Arguments

Content

View full analysis

Vulnerability Details

File Location: index.js:21-22
Vulnerability Type: OS command injection caused by unsafe shell interpolation
Risk Level: Critical

js

handler: async ({ command, workdir = '/workspace' }) => {
  try {
    const dockerCmd = `sudo docker exec -w ${workdir} astra-env bash -c "${command.replace(/"/g, '\\"')}"`;
    const { stdout, stderr } = await execAsync(dockerCmd);
    return { success: true, stdout: stdout || '(no output)', stderr };
  } catch (error) {
    return { success: false, error: error.message };
  }
}

Technical Analysis

The handler constructs a command string containing the user-controlled command and workdir values and executes it using child_process.exec. This API invokes a host shell, so shell metacharacters and command substitutions are interpreted before docker exec is launched.

The workdir value receives no validation or escaping. An attacker can inject shell separators or substitutions through it. The attempted protection for command only escapes double quotes and does not prevent constructs such as $() or backticks. Because command is placed inside host-shell double quotes, these substitutions can be evaluated by the host shell rather than exclusively inside the container.

Attack Path

1. The attacker obtains the ability to invoke the exposed docker_exec tool or influences its arguments.
2. The attacker places a shell payload in workdir, such as a value containing a command separator, or places command substitution syntax such as $(HOST_COMMAND) in command.
3. The handler concatenates the payload into dockerCmd.
4. execAsync passes the resulting string to the host shell.
5. The host shell evaluates the injected expression before or alongside docker exec.
6. The injected command runs with the privileges of the skill process. The intended Docker operation also uses sudo, increasing the potential impact where pas ...[truncated 628 chars]

Remediation

View remediation

Remediation Suggestions

• Replace exec with execFile or spawn and pass each Docker argument as a separate array element, with shell processing disabled.
• Do not construct a single shell command from user-controlled strings.
• Validate workdir as a normalized absolute container path and restrict it to /workspace or an explicitly approved subdirectory.
• If arbitrary commands are a required feature, pass the command as an isolated argument to the container process without allowing the host shell to parse it.
• Remove sudo and run the service with a narrowly scoped Docker authorization policy where possible.
• Apply container hardening, including a non-root container user, dropped capabilities, read-only mounts where feasible, and resource limits.
• Add tests covering shell substitutions, backticks, separators, newlines, traversal, and malformed paths.

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:41

Finding

Host and Container Command Injection Through docker_write_file

Content

View full analysis

Vulnerability Details

File Location: index.js:41-43
Vulnerability Type: OS command injection and unrestricted file-write path
Risk Level: Critical

js

handler: async ({ filepath, content }) => {
  try {
    const escapedContent = content.replace(/'/g, "'\\''");
    const dockerCmd = `sudo docker exec -w /workspace astra-env bash -c "echo '${escapedContent}' > ${filepath}"`;
    await execAsync(dockerCmd);
    return { success: true, message: `File written to ${filepath}` };
  } catch (error) {
    return { success: false, error: error.message };
  }
}

Technical Analysis

Both content and filepath originate from tool arguments and are incorporated into a shell command executed through execAsync.

filepath is neither validated nor escaped. It can therefore contain redirections, separators, command substitutions, or other shell syntax. This allows an attacker to transform the nominal file-write operation into arbitrary command execution inside the container. It also allows writes outside /workspace through absolute paths or path traversal if container permissions permit them.

Escaping single quotes in content is insufficient. The generated inner command is itself enclosed in double quotes for the host shell. Single-quote characters appearing inside those double quotes do not create a protected host-shell quoting context. Consequently, constructs such as $() or backticks supplied through content or filepath may be evaluated by the host shell before Docker executes the inner command.

Attack Path

1. The attacker invokes docker_write_file or causes attacker-controlled values to reach its filepath or content parameters.
2. The attacker supplies command-substitution syntax in content or filepath to target the host shell, or shell separators in filepath to append commands to the container-side shell expression.
3. The handler performs only single-quote replaceme ...[truncated 1165 chars]

Remediation

View remediation

Remediation Suggestions

• Eliminate shell-built file writes. Use spawn or execFile with an argument array and stream file content through standard input to a fixed program such as tee --.
• Ensure the host never parses user-controlled content or paths as shell syntax.
• Normalize the requested path and verify that the resolved destination remains beneath /workspace.
• Reject absolute paths, traversal components, null bytes, and destinations outside an explicit allowlist.
• Avoid echo for arbitrary file data because it can alter content and interpret implementation-specific options or escapes.
• Write through a purpose-built container API or application-level filesystem operation rather than invoking bash -c.
• Run the container as a non-root user and limit writable mounts and directories.
• Remove unnecessary sudo usage and restrict Docker permissions.
• Add security tests for command substitutions, backticks, redirections, separators, newlines, absolute paths, and traversal sequences.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

cat <<'EOF' > ~/.openclaw/workspace/skills/astra-docker/SKILL.md
---
name: astra-docker
description: "Execute commands, read files, and write files in Astra's Docker container workspace (astra-env). Use this skill whenever you need to interact with your virtual environment at /workspace."

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description is overly broad and encourages invocation whenever the agent needs to interact with the virtual environment, which grants sweeping command, file read, and file write access inside a persistent container. Broad activation criteria increase the chance of unnecessary or unsafe use of privileged workspace access, especially when combined with arbitrary command execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill instructs use of sudo docker exec to run arbitrary commands in a persistent container, effectively enabling privileged command execution against the container runtime. If misused, this can lead to container compromise, modification of persistent workspace contents, access to secrets present in the container, and potentially host-level impact depending on Docker configuration.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Execute a command

bash

sudo docker exec -w /workspace astra-env bash -c "YOUR_COMMAND_HERE"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This tool exposes arbitrary shell execution in the container by passing user-controlled command and workdir into bash -c through exec(). Although described as operating in a Docker workspace, there are no safeguards, no command allowlist, and no confirmation, so any caller can run arbitrary programs in the container and potentially abuse mounted secrets, network access, or Docker misconfiguration to affect the host.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The tool invokes sudo docker exec, meaning the skill requests elevated privileges on the host in order to control a container. In combination with arbitrary command execution, this materially raises the blast radius: compromise of the tool can become root-equivalent container control and may lead to host impact depending on Docker daemon privileges, mounted volumes, or container configuration.

Content

Scanner excerpt · index.js (reported line 24)May include surrounding context.

js

},
      handler: async ({ command, workdir = '/workspace' }) => {
        try {
          const dockerCmd = `sudo docker exec -w ${workdir} astra-env bash -c "${command.replace(/"/g, '\\"')}"`;
          const { stdout, stderr } = await execAsync(dockerCmd);
          return { success: true, stdout: stdout || '(no output)', stderr };
        } catch (error) {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file-writing tool allows arbitrary file writes inside the Docker container with no validation of the destination path, no restriction to a safe allowlisted subtree, and no confirmation barrier. Because filepath is interpolated directly into a shell command, an attacker can both overwrite sensitive files in the container and potentially inject additional shell syntax, turning a simple write primitive into arbitrary command execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The file-write path also uses sudo docker exec, so a caller gains privileged ability to modify files inside the target container. Since the destination path is attacker-controlled and embedded in a shell command, this can be used to alter startup scripts, configuration, or mounted files, and in some deployments may affect the host through bind mounts or privileged container settings.

Content

Scanner excerpt · index.js (reported line 46)May include surrounding context.

js

handler: async ({ filepath, content }) => {
        try {
          const escapedContent = content.replace(/'/g, "'\\''");
          const dockerCmd = `sudo docker exec -w /workspace astra-env bash -c "echo '${escapedContent}' > ${filepath}"`;
          await execAsync(dockerCmd);
          return { success: true, message: `File written to ${filepath}` };
        } catch (error) {

Static analysis

No suspicious patterns detected.