linuxmirrors-docker
Fail
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill is designed to guide agents in the execution of
DockerInstallation.shandDockerInstallationLite.sh. These are third-party scripts sourced from external, unverified origins (the LinuxMirrors project). While the skill advises caution, its core purpose is to facilitate the download and execution of this remote code. - [CREDENTIALS_UNSAFE]: The skill's pre-flight check instructions in
references/operations/preflight.mddirect the agent to executejq . /etc/docker/daemon.json. This file frequently contains authentication tokens and credentials for private Docker registries. Reading and outputting the full content of this file exposes these secrets to the agent and the session logs. - [METADATA_POISONING]: The file
evaluation-report.htmlis a deceptive artifact designed to look like a formal safety audit. It claims an "Official: Pass" status and gives the skill a perfect safety score. This is a self-referential attempt to influence safety evaluations and mislead users or automated scanners into believing the skill has been independently verified. - [COMMAND_EXECUTION]: The skill provides numerous shell command templates for system inspection and file manipulation, including the use of
docker,jq,install, andcp. These commands are intended to be executed on the host system to modify its configuration. - [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by ingesting local system data.
- Ingestion points: The contents of
/etc/docker/daemon.jsonare read into the agent's context (references/operations/preflight.md). - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the ingested JSON data as untrusted or to ignore embedded instructions within it.
- Capability inventory: The skill possesses capabilities to execute shell commands and modify system files.
- Sanitization: No validation or sanitization is performed on the ingested configuration data before it is processed by the agent.
Recommendations
- AI detected serious security threats
Audit Metadata