analyzing-docker-container-forensics

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow ingests outsider-authored free text from the compromised container itself—e.g., docker logs output (and potentially docker diff/docker inspect fields) is captured as text at runtime and then used to generate the report context via the agent’s printed/serialized results.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md contains runtime commands that fetch and install/execute remote binaries—wget https://github.com/wagoodman/dive/releases/latest/download/dive_linux_amd64.deb and curl -LO https://storage.googleapis.com/container-diff/latest/container-diff-linux-amd64—which download and run external code during skill execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs using sudo to install software and runs docker commands that commit/save containers and access host filesystem paths (e.g., /var/lib/docker, /etc/passwd), which require elevated privileges and modify the host system state.