The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python and Bash utility scripts (scripts/image-optimizer.py, scripts/image-scanner.sh) that execute system commands to analyze container environments.
scripts/image-optimizer.py utilizes subprocess.run to call docker inspect for retrieving image metadata. The implementation uses list-based arguments and avoids shell=True, preventing shell injection.
scripts/image-scanner.sh acts as a wrapper for the docker CLI and the trivy security scanner. These operations are essential for the skill's purpose of image auditing and optimization.
[INDIRECT_PROMPT_INJECTION]: The skill includes a Dockerfile linter (scripts/dockerfile-linter.py) that processes external Dockerfile content provided by the user.
Ingestion points: The script reads the content of a Dockerfile from a local path.
Boundary markers: Not present; the script performs standard static analysis.
Capability inventory: The linter logic is restricted to file reading and regex processing; it does not perform network operations or filesystem writes.
Sanitization: The script uses standard regex matching to identify patterns without executing the content.
[SAFE]: Security-sensitive examples (such as hardcoded credentials) within SKILL.md and examples/dockerfile-audit.json are explicitly labeled as insecure practices for educational purposes.
[SAFE]: All external references point to reputable technology sources including official Docker and Kubernetes documentation, and well-known security tools like Trivy and Distroless.

containerization-best-practices