The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides numerous examples that mount the host's Docker daemon socket (/var/run/docker.sock) into containers. This allows processes inside the container to control the host Docker service, effectively granting root-level access to the host machine. Evidence: found in SKILL.md (Example 8, 15) and EXAMPLES.md (Example 7, 8, 11, 15).
[PRIVILEGE_ESCALATION]: Instructions include patterns for mounting the host's root filesystem (/) and critical system directories (/proc, /sys) into containers. This practice exposes the entire host file system to the container, bypassing isolation boundaries. Evidence: found in SKILL.md (Example 9) and EXAMPLES.md (Example 9, 10).
[CREDENTIALS_UNSAFE]: Multiple configuration examples contain hardcoded credentials, such as database passwords and application secrets. While provided as examples, they encourage the use of plaintext secrets in version-controlled files. Evidence: widespread use of values like POSTGRES_PASSWORD=secret, JWT_SECRET=dev-secret, and MYSQL_ROOT_PASSWORD=root_secret across all provided files.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external configuration files (e.g., compose.yaml, .env) that can contain untrusted data, without providing sanitization or safety boundaries. * Ingestion points: SKILL.md and EXAMPLES.md (loading application configurations from the filesystem). * Boundary markers: None identified. * Capability inventory: Arbitrary shell command execution on the host and inside containers via the Docker CLI (docker compose up, exec, run). * Sanitization: None identified.

docker-compose-orchestration