docker-image-puller

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 1.3.1

Overview

This Docker image download skill is mostly purpose-aligned, but it needs review because it handles registry credentials and downloaded image content with avoidable security weaknesses.

Install only if you trust the publisher and can tolerate review-level risk. Avoid passing registry passwords on the command line, avoid debug mode with private registries, verify downloaded images independently before loading or running them, and review or update the mirror-mode execution path so it does not use shell pipelines with interpolated configuration.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/docker_image_puller.py:121

Finding

Registry credentials and bearer tokens may be exposed through process arguments, echoed input, and debug logs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:36

Finding

Documented mirror-mode execution uses a shell pipeline with insufficient validation of interpolated configuration

Content

View full analysis

' --socks5 --socks5-proxy '' -a ''", workdir="" ) ``` ```python exec( command="printf 'y\\ny\\n' | python3 docker_image_puller.py -i '' -a ''", workdir="" ) ``` The accompanying instruction states: ```text Use exec with shell=false (argument array) to avoid shell injection. ``` The Skill only explicitly constrains the image name: ```text The image name must be a valid Docker image reference containing only letters, digits, `/`, `:`, `-`, `.`, and `_`. ``` ### Technical Analysis The mirror-mode command contains a shell pipe and shell quoting. A pipe cannot be interpreted by a direct argument-array execution with `shell=false`; it requires a shell or equivalent pipeline orchestration. The documented implementation therefore conflicts with its claim that execution uses an argument array without shell parsing. Values such as ``, ``, ``, and `` are interpolated into command strings but are not given equivalent validation requirements. If the Agent implements the documented command through a shell, a malicious value containing a quote, command separator, substitution expression, or other metacharacter can escape the intended argument and execute an additional command. This behavior exceeds the minimum privilege needed to download an image. The task only requires launching a Python program with explicit arguments and providing configuration data; it does not require arbitrary shell interpretation. ### Attack Path 1. An attacker or untrusted workflow modifies `config.json`, or induces the user or Agent to save a crafted mirror, proxy, architecture, or script-directory value. 2. The Age ...[truncated 1297 chars]

Remediation

View remediation

--non-interactive ``` 3. Invoke the script through a true argument array without a shell: ```python [ "python3", "docker_image_puller.py", "--image", image, "--arch", arch, "--mirror-url", mirror_url, "--non-interactive" ] ``` 4. Set `shell=false` explicitly and do not include pipes, redirections, substitutions, or quoting syntax in the command. 5. Validate every externally controlled field: - Parse mirror URLs with a URL parser and allow only approved HTTPS schemes. - Validate proxy addresses as a hostname or IP plus a numeric port. - Restrict architecture to a fixed allowlist. - resolve and verify `script_dir` against the installed Skill directory. - Continue validating image references with an anchored parser or regular expression. 6. Treat `config.json` as untrusted input. Reject unexpected types, embedded control characters, shell metacharacters where irrelevant, and unknown configuration fields. 7. Avoid using stored absolute paths supplied by the package. Resolve the script directory relative to the Skill installation at runtime. 8. Add tests containing quote characters, semicolons, newlines, command substitutions, and redirection operators in every configuration field, confirming that none can alter process execution. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/docker_image_puller.py:177

Finding

Downloaded image blobs are packaged without verifying their declared cryptographic digests

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes command execution, background subagents, file access, and network operations, but does not declare any explicit tool scope or permissions boundary. In a skill that downloads remote artifacts and writes tar files, this increases the chance of overbroad execution capability, weak reviewability, and accidental abuse beyond the intended image-pull workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary user language such as 'pull xxx' or generic requests to download an image, which can cause the skill to activate unexpectedly. Because the skill performs network downloads and command execution, accidental invocation could initiate unreviewed background activity, consume bandwidth/disk, or pull unintended images.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language instructions and user-facing responses are written entirely in Chinese, and the skill does not indicate that language is configurable or user-selected. Under the policy, forcing a specific language without opt-in is a locale/language policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

User-facing text throughout the CLI is hard-coded in Chinese, including prompts, status messages, and help descriptions. This imposes a specific language/locale on all users without opt-in or documented justification, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.