container-hardening
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several well-known and trusted security tools and projects, including Aqua Security's Trivy, Anchore's Grype and Syft, Sigstore's Cosign, and Google's Distroless images. All links point to official documentation or verified GitHub repositories.
- [COMMAND_EXECUTION]: The instructions include example CLI commands for standard security operations, such as running vulnerability scans (
trivy image), generating SBOMs (syft), and signing images (cosign sign). These are legitimate uses of security tooling. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze external artifacts like Dockerfiles and container scan results. While these are untrusted data sources, the skill acts as a security reviewer to identify issues within them. The ingestion of these files is central to the skill's primary defensive purpose.
- [CREDENTIALS_UNSAFE]: The skill explicitly warns against including secrets, passwords, or API keys in container image layers and provides instructions on using safer alternatives like BuildKit secrets or runtime injection.
Audit Metadata