zeabur-dockerfile

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The PHP Dockerfile template fetches the install-php-extensions script from a third-party GitHub repository (mlocati/docker-php-extension-installer). This is a standard and widely recognized community tool for managing PHP extensions in Docker environments.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze project configuration files (such as package.json, requirements.txt, and Cargo.toml) to determine build and runtime commands. This represents a potential surface for indirect prompt injection if those files contain malicious instructions.
  • Ingestion points: Reads various local project files from the user's workspace in SKILL.md under the 'Prerequisites' section.
  • Boundary markers: None specified; the skill relies on the agent's ability to parse project metadata correctly.
  • Capability inventory: The skill generates Dockerfiles which include RUN and CMD instructions, which execute shell commands during the container build and startup process.
  • Sanitization: No specific sanitization or validation logic is provided for values extracted from project files before they are placed into the generated Dockerfile instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 04:29 PM