tao-run-on-docker
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for managing Docker containers through various lifecycle verbs (submit, status, logs, cancel). It also includes shell commands for administrative tasks, such as 'sudo systemctl stop docker' and using 'rsync' and 'mv' to relocate the Docker data root to different host volumes.
- [PRIVILEGE_ESCALATION]: The skill utilizes 'sudo' to manage Docker services and configure system files like '/etc/docker/daemon.json'. It also uses 'docker run' with host filesystem bind mounts and employs host identity mapping (--user and --group-add) to manage file permissions between the container and the host.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external job specifications ('spec.yaml') and command bundles, creating a potential surface for prompt injection from untrusted data sources. \n * Ingestion points: Job specification files and execution commands defined in external spec bundles. \n * Boundary markers: The skill references 'redact_secrets.py lint' for secret detection but does not implement robust structural delimiters for the input data. \n * Capability inventory: Full Docker execution, host filesystem access via mounts, and network access for image acquisition. \n * Sanitization: Relies on secret linting and identity mapping for output files, but lacks general command sanitization for containerized execution.
- [EXTERNAL_DOWNLOADS]: The skill performs 'docker pull' operations to fetch container images from registries such as 'nvcr.io'. These resources are retrieved from official and reputable vendor sources necessary for the skill's functionality.
Audit Metadata