docker-containerization

Warn

Audited by Socket on Sep 16, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/docker-build.sh

No direct evidence of embedded malware (e.g., exfiltration, backdoors, cryptomining) is present in this script. However, the script uses `eval` to execute a dynamically constructed `docker build` command that includes unsanitized, attacker-controlled CLI inputs—especially `--build-arg` and other flags—creating a serious command-injection risk on the build host/CI environment. In a supply-chain context, this can enable arbitrary command execution and potentially the production of malicious build artifacts, so the module should be refactored to avoid `eval` (e.g., construct a command array and execute it directly).

Confidence: 77%Severity: 82%
Audit Metadata
Analyzed At
Sep 16, 2026, 01:55 AM
Package URL
pkg:socket/skills-sh/ailabs-393%2Fai-labs-claude-skills%2Fdocker-containerization%2F@2a93031bc9f3075f52f27ab9ad59f78fd74a06d5745608e1f847e974fe3b4e5f