docker-development-env
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill correctly identifies that sensitive information should be stored in
.envfiles and explicitly warns users never to commit these secrets to version control. Examples use dummy development credentials (e.g., 'devuser', 'devpass') which is standard for instructional material. - [EXTERNAL_DOWNLOADS]: All referenced Docker images originate from official or well-known registries (Docker Hub for Node.js, Postgres, Redis, and MongoDB; Microsoft's Container Registry for devcontainers). These are considered trusted sources.
- [REMOTE_CODE_EXECUTION]: No suspicious remote script execution patterns (such as 'curl | bash') were detected. The workflows involve standard package management (e.g., 'npm install') within the context of building a local container image.
- [PRIVILEGE_ESCALATION]: The skill promotes security by including the 'USER node' instruction in production Dockerfile stages, ensuring the application runs with reduced privileges.
- [SAFE]: The instruction for 'docker-in-docker' features in devcontainers is a standard development feature provided by the official devcontainers specification and is used for nested container management in development environments.
Audit Metadata