This report does not block or authorize the manifest or ZIP.
Static analysis reported a critical heuristic because Docker command examples, localhost health checks, filesystem paths, and secret-management examples appear together in one instructional skill. Review found no prompt injection, hidden executable file, credential exfiltration, or malicious network target. The remaining risk is medium because the skill explicitly guides agents to run Docker CLI commands that can inspect, build, start, stop, and push containers when a user allows tool execution.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 409 Lines analyzed
2 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
TRUE POSITIVE for operational risk: the skill recommends shell fallback commands that inspect Docker state, build images, run containers, stop containers, and push multi-architecture images. This is legitimate for a Docker expert skill, but it can mutate the local Docker environment and should require normal tool approval and workspace review.
The commands are shown directly in fenced bash blocks and include docker build, docker run, docker stop, and docker buildx build --push. Confidence is high for operational risk, but no malicious intent or hidden execution path is present.
NEEDS REVIEW: the BuildKit example reads a secret from /run/secrets/api_key into an API_KEY shell variable during a build step. The surrounding section presents secrets management guidance, not exfiltration, but users could leak secrets into image layers if they adapt the pattern incorrectly.
The code is an instructional Dockerfile snippet rather than executable marketplace code. The risk depends on user adaptation, so the concern is moderate and context-dependent.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Fenced Docker and Compose Snippets Flagged as Command Execution
FALSE POSITIVE: most external command alerts occur inside Markdown examples for Dockerfile, Compose, and validation workflows. They are visible instructional snippets for the declared Docker domain and are not hidden scripts that execute when the skill loads.
The detected patterns are fenced examples and align with the skill purpose. No evidence found that the skill executes these snippets automatically.
FALSE POSITIVE: the hardcoded URLs are localhost health-check examples for Dockerfile and Compose health probes. They do not target an external domain and do not transmit credentials.
Both URLs point to http://localhost:3000/health inside documented health check examples. No evidence found of outbound data transfer.
FALSE POSITIVE: POSTGRES_PASSWORD_FILE, db_password, and api_key appear in examples explaining Docker secrets. The skill recommends avoiding environment-variable secrets and using Docker-managed secret files.
The context is secrets-management documentation, not credential harvesting. No evidence found of network transmission or logging of these values.
FALSE POSITIVE: /dev/null redirects, /root/.npm cache mounts, /run/secrets paths, and /usr/local/bin examples are normal Docker documentation patterns. They are not broad filesystem traversal or hidden file collection logic.
The paths appear in visible command examples and Dockerfile snippets. No evidence found of code that enumerates sensitive host files.
Keyword-Based Cryptography and Reconnaissance Flags
FALSE POSITIVE: weak-cryptography and reconnaissance alerts appear to be keyword matches in ordinary prose such as description text, checklist items, and routing guidance. No cryptographic operation or reconnaissance workflow is implemented.
The cited lines are documentation text, not runnable crypto or scanning code. No evidence found of weak algorithm use or network reconnaissance instructions.