The Agent Skills Directory

[SAFE]: The skill demonstrates a strong commitment to security best practices. No malicious behaviors, obfuscation, or unauthorized data access patterns were detected.\n- [EXTERNAL_DOWNLOADS]: Recommends industry-standard container security tools from reputable sources.\n
Evidence: Documentation and validation steps utilize docker scout, trivy, syft, grype, and cosign.\n
Note: References to these well-known tools are treated as safe and informative. The skill specifically warns against using compromised versions of these tools.\n- [COMMAND_EXECUTION]: Uses standard CLI commands to manage and audit container environments.\n
Evidence: Commands like docker build, docker compose, and podman are core to the skill's functionality.\n
Note: All commands are documented with security in mind, including using --check for build-time linting and non-privileged execution options.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied build and configuration files during analysis.\n
Ingestion points: Dockerfiles, Compose manifests, and project source code.\n
Boundary markers: Includes an extensive "AI Self-Check" and production checklist to verify that generated or reviewed configuration adheres to safety standards.\n
Capability inventory: Shell execution of container management and security scanning tools.\n
Sanitization: Recommends digest pinning, non-root users, and read-only filesystems to provide defense-in-depth against potentially malicious content.

docker