Secure Dockerfiles with Hadolint
Dockerfile mistakes can create insecure and unreliable container images. This skill provides Hadolint workflows, rule guidance, remediation examples, and reusable CI configurations.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "container-hadolint" from https://skillstore.io/skills/agentsecops-container-hadolint.md and its manifest at https://skillstore.io/api/skills/agentsecops-container-hadolint/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "container-hadolint". Review a Dockerfile that uses a mutable base image tag and runs as root.
Expected outcome:
Using "container-hadolint". Recommend a CI policy for a legacy repository with several Dockerfiles.
Expected outcome:
Start with the balanced policy, report warnings without blocking, then raise thresholds after the baseline findings are assigned and remediated.
Using "container-hadolint". Explain a warning about unpinned operating system packages.
Expected outcome:
Unpinned packages reduce reproducibility and can introduce unexpected updates. Pin supported versions and keep update, installation, and cache cleanup in one layer.
Most alerts are false positives from Markdown, reference links, placeholder credentials, and examples labeled as insecure. Actionable risks include unsafe CI filename handling and unverified latest-binary downloads. Mutable CI dependencies add supply-chain exposure, while no prompt injection or malicious intent was found.
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/agentsecops-container-hadolint/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/agentsecops-container-hadolint?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/agentsecops-container-hadolint?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-container-hadolint/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/agentsecops-container-hadolint.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>AgentSecOps. (2026). container-hadolint security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-container-hadolint/audits/10@techreport{agentsecops-agentsecops-container-hadolint-2026,
author = {AgentSecOps},
title = {container-hadolint security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/agentsecops-container-hadolint/audits/10},
note = {Author version 0.1.0}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "container-hadolint security audit report (audit version 10)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-container-hadolint/audits/10"
identifiers:
- type: other
value: "skillstore:agentsecops-container-hadolint:audit:10"
description: "Skillstore immutable audit report identifier"
Identify lint findings, understand their impact, and receive focused remediation steps before building an image.
Adapt the supplied workflow and configuration templates to enforce shared Dockerfile policies.
Compare Dockerfile practices with selected security guidance and document prioritized remediation.
Review [Dockerfile path] with Hadolint. Explain each finding in plain language and suggest the smallest secure change.
Compare the strict, balanced, and permissive configurations for [project context]. Recommend one and explain every necessary customization.
Design a Hadolint check for [GitHub Actions or GitLab CI]. Pin dependencies, handle all filenames safely, and define failure thresholds.
Analyze Hadolint results for [repository]. Group root causes, prioritize security impact, identify justified suppressions, and propose a phased remediation plan.
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r2
Repository
https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/container-hadolintRef
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
Maintenance freshness
7/24/2026
Usage
6 downloads · 358 views
File structure
Build pytm Threat Models as Code
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Run Authorized Nuclei Security Scans
Known vulnerabilities and misconfigurations can escape manual review. This skill guides authorized Nuclei scans, template selection, validation, and reporting.
Audit Code with Semgrep
Security flaws can remain hidden across large, multilingual repositories. This skill guides focused Semgrep scans, triage, custom rules, CI gates, and standards-aligned remediation.
Scan Dependencies and Containers with Trivy
Security teams need consistent visibility into vulnerable components, images, and infrastructure configuration. This skill provides practical Trivy workflows for assessment, reporting, and remediation.
Automate OWASP ZAP DAST Scans
Security teams need repeatable runtime testing before releases. This skill guides authorized OWASP ZAP scans, authentication setup, API testing, and CI reporting.
Scan Python Code with Bandit
Python security flaws can reach production unnoticed. This skill guides Bandit scans, prioritization, CI integration, and remediation with CWE and OWASP references.
Automate SecOps Checks
by alirezarezvani
Security teams need consistent review workflows across projects. This skill provides SecOps CLI scaffolds and reference guides for repeatable checks.
Configure SAST for DevSecOps Pipelines
by wshobson
Teams need repeatable security scans before code reaches production. This skill guides SAST setup, rule tuning, and CI gate configuration.
Build Reliable Test Automation
by 89jobrien
Weak tests slow releases and hide regressions. This skill guides test strategy, TDD, automation, coverage review, and Playwright web checks.
Plan Reliable Tests Across Your Codebase
by 0xDarkMatter
This skill helps teams choose test strategies, mocks, data fixtures, coverage gates, and CI patterns without mixing test scopes. It gives Claude, Codex, and Claude Code structured guidance for unit, integration, end-to-end, TDD, and pipeline testing.
Automate DevOps Pipelines and Deployments
by alirezarezvani
DevOps work often requires repeatable pipeline, infrastructure, and deployment patterns. This skill provides scripts and reference guides for CI/CD, IaC, deployment, and operations review.
Coordinate Cloud DevOps Workflows
by sickn33
Cloud delivery work often spans many tools and phases. This skill organizes infrastructure, CI/CD, Kubernetes, monitoring, security, costs, and recovery work into clear prompts.