Docker 镜像拉取工具

• Analyzed: May 12, 2026, 4:26 AM
• Findings: 1
• Version: 1.2.1
• Hash: dc05fc0f0bb910e31f40f2b2ba83e3d2b074da0ddffacda9bb7536810188fbc2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several security vulnerabilities and high-risk patterns. The Python script `scripts/docker_image_puller.py` explicitly disables SSL certificate verification (`verify=False`) and suppresses related warnings, which exposes the agent to Man-in-the-Middle (MITM) attacks during image downloads. Additionally, the `SKILL.md` instructions guide the AI agent to construct shell commands by directly embedding unvalidated user input (the image name) into a command string for the `exec` tool, creating a significant shell injection vulnerability. While the tool's functionality is aligned with its stated purpose of pulling Docker images, these implementation flaws represent meaningful security risks in an automated agent environment.