Security audit

Deployment Kit

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Docker deployment helper, but it needs review because configurable values are interpolated into shell commands that can change Docker state.

Review before installing on any machine with important Docker access. Use only trusted configuration values, avoid exposing monitoring ports publicly, pin external image versions where possible, and add branch protection, approvals, rollback, and cleanup procedures before using this for production deployment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation states that pushes to main trigger deployment to production, but it does not clearly warn users that normal source control activity can cause changes to live systems. In a deployment-focused skill, this creates a real operational safety risk because users may adopt the workflow without adding approvals, environment protections, or rollout safeguards, increasing the chance of accidental production changes.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: This code constructs shell commands with unsanitized configuration values and executes them via exec(), which invokes a shell. If an attacker can control imageName, containerName, or port through config, they may inject arbitrary shell syntax and achieve command execution on the host during build or deployment.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.