T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_build_dockerfile.py:107- Finding
Dockerfile Instruction Injection Through Unvalidated Version Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
project-containerize
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with containerizing projects, but it needs review because it can duplicate live configuration secrets and run Docker build/deploy workflows with limited safety controls.
Review before installing or using on a real project. Run it only on repositories where Docker builds are acceptable, inspect generated deploy/ files before executing them, avoid running it against projects with live .env or secret-bearing config files, and prefer non-root containers with pinned images and package-manager versions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/prepare_configs.py:12- Finding
Live Environment Files and Secrets Are Recursively Copied Into Deployment Output
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_deployment.py:53- Finding
Generated Deployment Script Unsafely Parses and Expands Environment Values
- Content
View full analysis
/dev/null || true docker rm $CONTAINER_NAME 2>/dev/null || true echo "=== Start new container ===" docker run -d \ --name $CONTAINER_NAME \ -p "$APP_PORT:$APP_PORT" \ --env-file .env \ --restart unless-stopped \ $IMAGE_NAME echo "=== Check service status ===" if docker ps | grep -q $CONTAINER_NAME; then docker logs --tail 20 $CONTAINER_NAME else docker logs $CONTAINER_NAME exit 1 fi ``` ### Technical Analysis The construct `export $(cat .env | grep -v '^#' | xargs)` is not a safe dotenv parser. Command substitution and shell word splitting reinterpret the file contents as shell words. Values containing spaces, quotes, wildcard characters, malformed assignments, or leading dashes can be split or transformed unexpectedly. Values derived from `APP_NAME` are subsequently expanded without quotes in commands that control Docker: ```bash docker build -t $IMAGE_NAME ... docker stop $CONTAINER_NAME docker rm $CONTAINER_NAME docker run --name $CONTAINER_NAME ... $IMAGE_NAME ``` Unquoted expansion permits a crafted value to become multiple arguments or options. While shell metacharacters produced by variable expansion are not generally reparsed as new shell operators, argument and option injection remains possible. This is particularly sensitive because Docker access commonly provides extensive control ove ...[truncated 1336 chars]- Remediation
View remediation
&2 exit 1 ;; esac ``` 5. Validate `APP_PORT` as an integer in the range `1` through `65535`. 6. Quote every variable expansion: ```bash docker build -t "$IMAGE_NAME" -f Dockerfile .. docker stop "$CONTAINER_NAME" docker rm "$CONTAINER_NAME" docker run --name "$CONTAINER_NAME" "$IMAGE_NAME" ``` 7. Use fixed-string matching and option termination: ```bash docker ps --format '{{.Names}}' | grep -Fqx -- "$CONTAINER_NAME" ``` 8. Add tests for whitespace, leading dashes, wildcard characters, quotes, and malformed dotenv entries. ]]>
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/generate_deploy_dockerfile.py:9- Finding
Generated Application Containers Default to Root Execution
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/generate_build_dockerfile.py:151- Finding
Generated Builds Use Mutable Images and Unpinned Package-Manager Dependencies
- Content
View full analysis
- Remediation
View remediation
AS exporter ``` 5. Use explicit image versions instead of broad tags such as `latest` or `alpine`. 6. Automate controlled digest updates through a reviewed dependency-update process. 7. Generate software bills of materials and scan both build and runtime images. 8. Verify provenance and signatures for base images when supported by the deployment environment. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (53)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
该代码块是一个“阶段1”分析脚本，功能集中在读取项目目录结构与常见文件，检测技术栈，查找现有 Dockerfile，扫描配置和文档，并输出一份 Markdown 分析报告。它确实与“容器化”领域相关，属于容器化前置分析的一部分，但与声明中的核心能力存在明显差距：声明强调自动配置和优化容器化方案、生成 Dockerfile、生成 compose.yaml、输出最终部署方案；而实际代码没有任何模板渲染、文件生成功能（除分析报告外），也没有构建/部署编排逻辑。因此描述将该技能表述为完整容器化适配工具，而代码实际只是分析阶段组件，属于功能性描述不准确、主目的缩窄明显的情况。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
声明描述的是一个覆盖面较广的“完整容器化改造/部署方案生成”技能，而代码行为明显更窄：这是一个专门生成构建阶段 Dockerfile 的脚本。它会读取少量常见配置文件来推断语言版本或包管理器，并按传入的项目类型模板化输出 Dockerfile.build。虽然这与“容器化”领域相关，属于声明的一部分支撑能力，但远未达到声明中的完整能力范围。尤其缺少 compose.yaml 生成、部署文档生成、完整运行容器方案、自动项目识别与整体编排。因此描述对实际能力有明显夸大，构成描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
声明描述的是一个“完整容器化适配”能力集合，范围包括自动分析项目、优化容器化打包方案、生成 Dockerfile 与 compose.yaml、输出文档和完整部署方案。而实际代码块的职责明显更窄：它只是一个部署 Dockerfile 生成脚本，基于用户提供的 project_type 选择预定义模板，写出 deploy/Dockerfile。虽然这与声明中的“生成 Dockerfile”部分一致，但缺失了声明中的多个核心能力，尤其是 compose.yaml 生成、说明文档生成、完整项目分析、以及整体部署方案产出。因此描述明显夸大了该代码块的实际功能，属于描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个端到端的项目容器化能力，核心输出应包括 Dockerfile、compose.yaml 以及完整部署方案。而提供的代码块功能范围明显更窄，仅是“阶段4”的配置准备脚本：查找配置文件、复制到部署目录、生成环境变量模板和配置说明文档。虽然这些行为可作为容器化流程的辅助步骤，且文档中提到容器挂载路径，但它并没有实际生成任何容器构建/编排文件，也没有体现自动检测分析项目代码文档或优化打包方案的能力。因此，代码实际行为与声明的主要用途存在实质性不匹配。
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill does not warn that it will execute Docker build and deployment commands on the user's system. That omission is dangerous because builds and startup can run arbitrary project-defined logic, consume resources, open ports, and pull remote dependencies without informed approval.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python } # 环境变量文件 for f in ['.env', '.env.example', '.env.template', '.env.local', 'config.env']: if os.path.exists(os.path.join(project_path, f)): configs['env_files'].append(f)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The generated shell script reads .env and exports its contents using 'export $(cat .env | grep -v '^#' | xargs)'. This is an unsafe pattern because shell word-splitting and parsing can corrupt secret values, mishandle special characters, and potentially alter shell behavior if the file contains unexpected content; in a deployment skill, .env commonly contains credentials, so the context increases sensitivity.
- Content
python set -e # 加载环境变量 if [ -f .env ]; then export $(cat .env | grep -v '^#' | xargs) fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
This is the continuation of the same unsafe .env-loading logic and therefore carries the same risk: secrets in .env are injected into the current shell environment through fragile parsing. In deployment automation, that broadens exposure of credentials to subprocesses and increases the chance of accidental leakage via debugging, process environments, or malformed variable parsing.
- Content
python # 加载环境变量 if [ -f .env ]; then export $(cat .env | grep -v '^#' | xargs) fi # 镜像名称
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ├── compose.yaml # 部署编排（含配置挂载） ├── compose.build.yaml # 打包编排 ├── docker-run.sh # 部署脚本 ├── .env # 环境变量配置 ├── artifacts/ # 打包制品目录 ├── config/ # 配置文件目录 │ └── [项目原有配置文件]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ├── compose.yaml # 部署编排（含配置挂载） ├── compose.build.yaml # 打包编排 ├── docker-run.sh # 部署脚本 ├── .env # 环境变量配置 ├── artifacts/ # 打包制品目录 ├── config/ # 配置文件目录 │ └── [项目原有配置文件]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ├── compose.yaml # 部署编排（含配置挂载） ├── compose.build.yaml # 打包编排 ├── docker-run.sh # 部署脚本 ├── .env # 环境变量配置 ├── artifacts/ # 打包制品目录 ├── config/ # 配置文件目录 │ └── [项目原有配置文件]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ├── compose.yaml # 部署编排（含配置挂载） ├── compose.build.yaml # 打包编排 ├── docker-run.sh # 部署脚本 ├── .env # 环境变量配置 ├── artifacts/ # 打包制品目录 ├── config/ # 配置文件目录 │ └── [项目原有配置文件]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ├── compose.yaml # 部署编排（含配置挂载） ├── compose.build.yaml # 打包编排 ├── docker-run.sh # 部署脚本 ├── .env # 环境变量配置 ├── artifacts/ # 打包制品目录 ├── config/ # 配置文件目录 │ └── [项目原有配置文件]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ├── compose.yaml # 部署编排（含配置挂载） ├── compose.build.yaml # 打包编排 ├── docker-run.sh # 部署脚本 ├── .env # 环境变量配置 ├── artifacts/ # 打包制品目录 ├── config/ # 配置文件目录 │ └── [项目原有配置文件]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ├── compose.yaml # 部署编排（含配置挂载） ├── compose.build.yaml # 打包编排 ├── docker-run.sh # 部署脚本 ├── .env # 环境变量配置 ├── artifacts/ # 打包制品目录 ├── config/ # 配置文件目录 │ └── [项目原有配置文件]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ├── compose.yaml # 部署编排（含配置挂载） ├── compose.build.yaml # 打包编排 ├── docker-run.sh # 部署脚本 ├── .env # 环境变量配置 ├── artifacts/ # 打包制品目录 ├── config/ # 配置文件目录 │ └── [项目原有配置文件]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ├── compose.yaml # 部署编排（含配置挂载） ├── compose.build.yaml # 打包编排 ├── docker-run.sh # 部署脚本 ├── .env # 环境变量配置 ├── artifacts/ # 打包制品目录 ├── config/ # 配置文件目录 │ └── [项目原有配置文件]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # JWT_SECRET=your-secret-key """ env_path = os.path.join(project_path, 'deploy', '.env') with open(env_path, 'w') as f: f.write(env_content)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # JWT_SECRET=your-secret-key """ env_path = os.path.join(project_path, 'deploy', '.env') with open(env_path, 'w') as f: f.write(env_content)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill clearly instructs reading project files, writing deployment artifacts, and executing Docker commands, yet it declares no explicit tool scope or permissions boundaries. That mismatch increases the chance of overbroad execution in environments where tool access is policy-driven, and makes the skill harder to review safely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description says it will analyze code and docs but does not clearly warn that it may read environment templates and configuration files that can contain secrets or sensitive infrastructure details. Missing disclosure reduces informed consent and can cause operators to expose more data than expected during use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow creates multiple files under
deploy/but does not clearly warn users that existing files may be created or overwritten. In operational contexts, silent workspace modification can destroy local changes or introduce deployment artifacts that are later committed unintentionally.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill goes beyond planning and file generation by directing execution of
docker compose ... up --build, which builds and starts code from the target project. In the context of an analysis/generation skill, automatically moving into build-and-run behavior can execute untrusted build steps, network fetches, post-install hooks, or service startup code with significant side effects.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs copying original configuration files, including
.envand app configs, intodeploy/config/, which can duplicate live credentials, tokens, and internal endpoints into a broader, more portable directory. In a containerization skill, this is especially dangerous because deployment folders are often committed, shared, or packaged, increasing the chance of secret exposure.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill lacks a clear warning that it copies original configuration into a deployment directory, potentially duplicating secrets into a place that is easier to archive, commit, or share. In deployment-focused workflows, this materially raises accidental credential leakage risk.
- Content
Static analysis
No suspicious patterns detected.