infra-ci-cd-docker
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides infrastructure patterns for building environments that ingest and process external source code and data.\n
- Ingestion points: Docker build context (source files), environment variables (e.g., APP_VERSION), and package manager manifests.\n
- Boundary markers: Mandatory use of .dockerignore to exclude sensitive files and multi-stage builds to prevent build-time artifacts from persisting in production.\n
- Capability inventory: Instructions include file system writes, package installation (npm ci, apk add), and shell command execution (RUN, CMD, ENTRYPOINT).\n
- Sanitization: Patterns include running containers as non-root users (USER), using read-only filesystems, and dropping Linux capabilities to limit execution scope.\n- [EXTERNAL_DOWNLOADS]: The skill references standard base images and software packages from trusted public registries.\n
- Pulls base images for Node.js, PostgreSQL, and Redis from Docker Hub and GitHub Container Registry.\n
- Installs development tools and runtime dependencies using npm and the Alpine package manager (apk).\n
- Incorporates official GitHub Actions from the 'actions' and 'docker' organizations for building, scanning, and deploying container images.
Audit Metadata