docker-containers

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains hard-coded plaintext credentials (e.g., devpass, guest, MSSQL_SA_PASSWORD) in example docker-compose and comments, which would require the LLM to reproduce secret values verbatim if asked to emit or modify those configs, creating a secret-exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill pulls and runs external container images during build/runtime (e.g., mcr.microsoft.com/dotnet/sdk:10.0, mcr.microsoft.com/dotnet/aspnet:10.0, postgres:16-alpine, redis:7-alpine, rabbitmq:3-management-alpine), which are fetched at runtime and execute remote code required for the service.