linuxmirrors-docker

Fail

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill is designed to guide agents in the execution of DockerInstallation.sh and DockerInstallationLite.sh. These are third-party scripts sourced from external, unverified origins (the LinuxMirrors project). While the skill advises caution, its core purpose is to facilitate the download and execution of this remote code.
  • [CREDENTIALS_UNSAFE]: The skill's pre-flight check instructions in references/operations/preflight.md direct the agent to execute jq . /etc/docker/daemon.json. This file frequently contains authentication tokens and credentials for private Docker registries. Reading and outputting the full content of this file exposes these secrets to the agent and the session logs.
  • [METADATA_POISONING]: The file evaluation-report.html is a deceptive artifact designed to look like a formal safety audit. It claims an "Official: Pass" status and gives the skill a perfect safety score. This is a self-referential attempt to influence safety evaluations and mislead users or automated scanners into believing the skill has been independently verified.
  • [COMMAND_EXECUTION]: The skill provides numerous shell command templates for system inspection and file manipulation, including the use of docker, jq, install, and cp. These commands are intended to be executed on the host system to modify its configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by ingesting local system data.
  • Ingestion points: The contents of /etc/docker/daemon.json are read into the agent's context (references/operations/preflight.md).
  • Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the ingested JSON data as untrusted or to ignore embedded instructions within it.
  • Capability inventory: The skill possesses capabilities to execute shell commands and modify system files.
  • Sanitization: No validation or sanitization is performed on the ingested configuration data before it is processed by the agent.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 4, 2026, 07:22 PM
Security Audit — agent-trust-hub — linuxmirrors-docker