docker-patterns

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt contains plaintext credentials and an API-key-like placeholder (e.g., postgres:postgres, POSTGRES_PASSWORD: postgres, ENV API_KEY=sk-proj-xxxxx) and shows hardcoded secrets in config examples, which encourages or could cause the LLM to reproduce secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill includes runtime pulls of external container images (e.g., FROM node:22-alpine in the Dockerfile and images referenced in docker-compose.yml such as postgres:16-alpine, redis:7-alpine, and axllent/mailpit) which are fetched from external registries and executed as code when building/starting the stack, so they are runtime external dependencies that execute remote code.