docker-ci-release-pipeline

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent for generating Docker release pipelines, but it should be reviewed because its generated CI example can publish images and uses an unpinned third-party GitHub Action.

Review generated workflows before committing them. Pin third-party GitHub Actions to reviewed versions or commit SHAs, set least-privilege workflow permissions, confirm the target registry and tags, and make sure image publishing only happens on intended branches or protected releases.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:68

Finding

Mutable Third-Party GitHub Action Reference

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 68
Vulnerability Type: Unpinned third-party CI dependency
Risk Level: Medium

Vulnerable Code:

yaml

- name: Security scan
  uses: aquasecurity/trivy-action@master

Technical Analysis

The example workflow references aquasecurity/trivy-action through the mutable master branch rather than a reviewed, immutable commit SHA. Consequently, the code executed by future workflow runs can change without any corresponding change to this project.

GitHub Actions run within the workflow job's security context. Depending on the generated workflow configuration, an action can interact with the checked-out repository, workspace files, artifacts, GitHub token, and credentials made available to the job. If the upstream repository or branch is compromised, force-updated, or modified maliciously, the workflow could execute attacker-controlled code.

Attack Path

1. An attacker compromises the upstream action repository, a maintainer account, or the mutable master branch.
2. The attacker modifies the action code referenced by aquasecurity/trivy-action@master.
3. A repository uses the sample or generated workflow and triggers it through a push, pull request, or tag.
4. GitHub resolves @master to the attacker-controlled revision and executes it on the runner.
5. The malicious action accesses resources available to the job, potentially including source files, workflow tokens, registry credentials, or build artifacts.
6. The attacker may exfiltrate accessible credentials, modify artifacts, or tamper with a container image before publication.

Impact Assessment

Successful exploitation could permit arbitrary code execution within the CI runner and access to all resources granted to that workflow step. The precise scope depends on repository settings, event type, token permissions, and secret exposure.

Potential consequences include source-code t ...[truncated 311 chars]

Remediation

View remediation

Remediation Suggestions

Pin the third-party action to a full, reviewed commit SHA:

yaml

- name: Security scan
  uses: aquasecurity/trivy-action@FULL_REVIEWED_COMMIT_SHA

Additionally:

1. Record the release tag corresponding to the pinned SHA in a comment for maintainability.
2. Review dependency updates before replacing the SHA.
3. Use an automated dependency-update tool that proposes reviewed SHA updates.
4. Pin every third-party GitHub Action generated by the Skill, not only Trivy.
5. Define explicit, least-privilege workflow permissions.
6. Expose registry credentials and other secrets only to steps that require them.
7. Separate scanning from image publication where practical, and require successful scans and protected-environment approval before publishing.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill description is entirely in Chinese and presents activation and usage instructions only in that language, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases Docker构建, 镜像发布, and especially CI/CD are broad operational terms that can match many normal developer conversations and unintentionally activate the skill. In a skill that can generate build, test, and release pipeline artifacts, accidental activation increases the chance of unsolicited workflow generation or release-oriented guidance being injected into unrelated tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly describes generating workflows that can push Docker images to a remote registry, but it does not clearly warn the user that executing the produced workflow may publish release artifacts externally. In a CI/CD and container-release context, lack of this warning can lead to unintended publication of proprietary code, vulnerable images, or test builds to GHCR or another registry.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Using the trigger phrase CI/CD is overly broad and can cause the skill to activate for many unrelated automation requests, increasing the chance that users invoke a pipeline capable of building and publishing artifacts when they did not intend to. In this skill's context, the capability includes registry pushes and release automation, so accidental activation is more risky than for a read-only helper skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list contains very broad terms such as Docker build, image publishing, CI/CD, and GitHub Actions, which can cause this skill to activate for many unrelated requests. In an agent environment, overbroad activation increases the chance that a powerful release/publishing workflow is invoked outside its intended context, potentially generating or recommending risky CI/CD automation for the wrong task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Natural-language policy violations include forcing a specific language without user opt-in. The manifest description, category, and triggers are all Chinese-language only, and the document does not indicate that this skill is intentionally limited to Chinese-speaking users or provide any language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The natural-language content in the manifest is entirely in Chinese, with no indication that the skill supports other languages or that Chinese-only behavior is intentional and justified for a region-specific use case. This can violate language-choice policy if the skill implicitly constrains interaction language without user opt-in.

Content

No source excerpt is available for this finding.