docker-image-signing
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from users and incorporates it into command-line operations.
- Ingestion points: User-provided image details, including registry, repository, and tags, are ingested as inputs in
SKILL.md. - Boundary markers: The instructions do not define delimiters or specific warnings to ignore instructions embedded in the image metadata or tags.
- Capability inventory: The skill provides capabilities to execute commands through the
docker_trustInspect,docker_trustSign,docker_trustRevoke, anddocker_trustKeytools mentioned inSKILL.md. - Sanitization: There is no evidence of input validation, escaping, or filtering for the external image details before they are used in tool invocations.
- [DATA_EXFILTRATION]: The skill references the official Docker Notary service at
https://notary.docker.iofor managing trust metadata. This is a well-known service associated with the Docker ecosystem.
Audit Metadata