ClawHub
Back to skill

Security audit

docker-image-puller

Security checks across malware telemetry and agentic risk

Overview

The skill does what it claims, but it should be reviewed carefully because it can run background downloads and handles private registry passwords in an unsafe way.

Install only if you are comfortable with a skill that runs a Python downloader, contacts Docker registries or mirrors, writes image tar files, and may run in the background. Avoid entering sensitive registry passwords unless the skill is updated to use hidden password entry or token-based auth, and verify the configured script path before first use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill instructs the agent to read and write local files, spawn sub-agents, access the network, and execute Python commands, but it does not declare any permissions. This creates a dangerous mismatch between the apparent trust boundary and the actual capabilities, making it easier for a powerful skill to be invoked without adequate review or user awareness.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases include broad everyday expressions such as '下载镜像', '拉取镜像', and 'pull xxx', which can cause the skill to activate in contexts the user did not intend. Because this skill performs network access and command execution, accidental triggering could lead to unintended downloads, file creation, and background task execution.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The script interactively collects registry credentials and sends them to an authentication endpoint, but it does not warn users about sensitive handling and reads the password with plain input, which can expose it on-screen or in terminal capture/logging contexts. In a tool whose purpose is pulling images from potentially private registries, this increases the risk of credential disclosure through local observation or unsafe operational use.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.