Dockerfile Hardening Audit

Use this skill to statically audit Dockerfiles before insecure container defaults land in production.

What this skill does

• Scans Dockerfiles and scores hardening risk per file
• Flags missing non-root USER declarations
• Flags base images using floating tags (:latest, :main, :master, :edge) or no tag/digest
• Flags missing HEALTHCHECK
• Flags ADD instructions (when COPY is safer/clearer)
• Flags curl|bash/wget|sh style remote script execution
• Supports include/exclude regex filters and fail-gate mode