The Agent Skills Directory

[DATA_EXFILTRATION]: The skill includes defensive measures to prevent sensitive data exposure by providing a robust .dockerignore configuration that explicitly excludes secrets, environment files (.env), and private keys (*.pem, *.key) from being baked into image layers.
[PRIVILEGE_ESCALATION]: Implements runtime security hardening via compose.yaml and Docker execution flags, such as no-new-privileges:true, cap_drop: ["ALL"], and mandatory non-root UID/GID assignments to prevent containers from gaining unauthorized host or kernel access.
[EXTERNAL_DOWNLOADS]: References legitimate and well-known external resources, including official Google Distroless images for minimal runtimes and the vendor's own Ruby images (ghcr.io/zewelor/ruby) for specific language support. These references are consistent with the skill's purpose and follow vendor resource patterns.
[COMMAND_EXECUTION]: Instructions guide the agent to use standard, well-documented package management commands (npm ci, pip install, bundle install) within isolated build stages, adhering to multi-stage build best practices to keep production images clean.
[SAFE]: The skill is primarily focused on hardening and security optimization, providing guidance that aligns with industry standards for container security, such as network isolation (--network none) and read-only filesystems.

docker