container-host-aiops

• Outcome: Review
• Latest audit: Aug 10, 2026 · 7:04 AM UTC
• Version: 0.10.0

Overview

This skill is transparent about its purpose, but it should be reviewed because it can control a container host with root-equivalent access and lacks built-in approval or read-only gates for destructive writes.

Install only for trusted container-host administration. Prefer a read-only socket or a Portainer account without write scope for observation, restrict Docker/Podman socket and Portainer token access to trusted admins, require dry-run review before writes, and treat prune/remove/recreate operations as potentially irreversible. Protect and periodically clean up ~/.container-host-aiops audit, undo, config, and encrypted secret files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The account you connect with.** Give it a Docker socket mounted read-only,

• Confidence: 94% confidence
• Finding: The document explicitly states that the tool does not enforce read-only mode or approval for write actions, and relies instead on external account permissions or the agent prompt. In an agentic setting, prompt-only restrictions are weak security boundaries: a misaligned, compromised, or prompt-injected model could invoke destructive write tools if the connected account has write scope.

Session Persistence

Medium

• Category: Rogue Agent

Content

homepage: https://github.com/AIops-tools/Container-Host-AIops
tags: [aiops, mcp, governance, container-host]
description: >
  Use this skill whenever the user needs to operate a single container host through the Docker Engine API, Portainer, or Podman — a one-shot host overview; container reads (list/inspect, logs tail, CPU/memory stats, top processes, restart summary); image reads (list, inspect with history, dangling, disk usage); volume reads (list, inspect, dangling); network reads (list, inspect); system reads (info, version, df disk-usage, recent events); Portainer stacks + endpoints; Compose-project rollups (list_compose_stacks, docker+podman); Podman pods (list_pods, podman-only); three flagship analyses — restart-loop RCA (crash-looping containers + cause/action), resource-pressure analysis (CPU/memory vs limits), and image & volume bloat (prune candidates + reclaimable bytes); and eight guarded writes (restart/stop/start/remove a container, prune images/volumes, update resource limits, recreate a Portainer stack).
  Always use this skill for "Docker host overview", "which containers are crash-looping", "restart loop", "why does this container keep restarting", "container CPU/memory usage", "docker logs", "which containers are near their limits", "resource pressure", "dangling images/volumes", "reclaim disk", "prune images", "stop/start/restart a container", "update a container's memory limit", "Portainer stacks", "compose stacks", "Podman pods" when the context is a Docker, Portainer, or Podman container host.
  Do NOT use when the target is a cluster orchestrator, a hypervisor, a storage appliance, a backup product, network device config, or OT/industrial equipment — route those to the appropriate other AIops-tools skill. This is for NON-orchestrator container hosts.
  Governed Docker/Portainer/Podman container-host operations with a built-in governance harness (audit, policy, token budget, undo, risk-tiers). Exercised against a live Docker Engine 27.5.1 
...[truncated 25 chars]

• Confidence: 82% confidence
• Finding: The skill explicitly persists operational state locally, including audit logs and undo data under ~/.container-host-aiops/. On a container-host operations skill, this can retain sensitive infrastructure metadata, container identifiers, stack details, and action history that may be exposed to other local users, backups, or later sessions if retention and access controls are weak.

Session Persistence

Medium

• Category: Rogue Agent

Content

4. If the cause is memory: `container-host-aiops analyze resource-pressure --mem 75` →
   see how close the container runs to its ceiling, then
   `container-host-aiops manage update <id> '{"Memory": 1073741824}' --dry-run` and
   re-run without `--dry-run` (double-confirm; the write captures the prior limits as its
   undo descriptor).
5. `container-host-aiops manage restart <id>` → bring it up on the new limit, then
   re-run `analyze restart-loop` to confirm the loop stopped.

• Confidence: 85% confidence
• Finding: The workflow states that writes capture prior limits as an undo descriptor, which is a form of session/state persistence. Even if intended for recovery, storing previous container configuration can leak sensitive operational details and creates residual state that may be abused or misapplied in later sessions on a root-equivalent container-management surface.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 2. What you need

- **Docker (unix socket)** — read/write access to the Docker socket (default
  `/var/run/docker.sock`). No secret is stored; the socket's file permissions are
  the trust boundary. Treat socket access as **root-equivalent** on the host.
- **Docker (TCP)** — a host + port (2375 plain, 2376 TLS). Enable TLS in

• Confidence: 91% confidence
• Finding: The guide explicitly requires read/write access to the Docker socket and correctly notes that such access is root-equivalent on the host. In the context of an AI-operated skill that includes guarded write actions, granting an agent or broad user population access to `/var/run/docker.sock` materially increases the risk of host takeover, container escape via privileged container creation, filesystem mounting, and credential access if the skill or surrounding agent is misused.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/agent-guardrails.md:41