dck-dockerfile
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
devcontainer-kittool from the author's official GitHub repository. The skill specifies a pinned version (v1.0.1) and requires explicit user consent for installation. - [COMMAND_EXECUTION]: Utilizes shell commands to initialize project configurations (
dck init), manage Docker builds, and perform environment validation. It implements a resource locking mechanism using a file-based lock at/tmp/dck-build.lockto coordinate concurrent build operations. - [DYNAMIC_EXECUTION]: Performs automated verification by executing commands (such as
nvim,herdr, andak) within the built Docker container. This activity is restricted to the container's isolated environment. - [INDIRECT_PROMPT_INJECTION]: The skill reads project-specific files (e.g.,
package.json,pyproject.toml,.nvmrc) to automatically detect environment requirements. To mitigate risk, it includes an explicit instruction to treat these files as data rather than instructions and requires the user to review and confirm all proposed changes and file diffs before they are applied.
Audit Metadata