The Agent Skills Directory

[SAFE]: The skill provides educational examples of security vulnerabilities, such as hardcoded secrets in ENV/ARG instructions or insecure port mappings, which are clearly marked with negative markers (❌) as practices to avoid.
[INDIRECT_PROMPT_INJECTION]: The scripts/scan.sh script ingests content from local files (Dockerfile, docker-compose.yml) to perform security audits. While this represents a surface for processing untrusted data, the script uses standard text-processing tools like ripgrep and grep for pattern matching without risky execution or interpolation of the ingested content into agent prompts.
[COMMAND_EXECUTION]: The skill contains a bash script (scripts/scan.sh) that uses standard system utilities (find, grep, ripgrep) to perform local audits. These commands are executed locally for the purpose of security scanning and do not involve network operations or privilege escalation.

security-docker