docker

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes an explicit plaintext password in the docker-compose example (POSTGRES_PASSWORD: password) and shows insecure patterns (secrets in ENV/ARG) that encourage embedding secrets verbatim, so the LLM would be handling/outputting secret values directly if it repeats or generates similar examples.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt includes explicit host-affecting Docker commands (e.g., docker system prune -af --volumes) that will modify or delete host images/volumes and also shows user creation in Dockerfiles (useradd/adduser) which, while typically inside images, encourages state-changing operations during build/run—so it pushes actions that can compromise the machine state.