The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides example Dockerfiles (examples/bad-example.Dockerfile, examples/security-issues.Dockerfile) containing hardcoded placeholder secrets such as API_KEY=secret123 and DATABASE_PASSWORD=admin. These are explicitly labeled as intentional vulnerabilities used to verify the validator's detection capabilities.
[EXTERNAL_DOWNLOADS]: The validation script (scripts/dockerfile-validate.sh) automatically fetches and installs the hadolint-bin and checkov packages from the Python Package Index (PyPI) if they are not already present on the system. These are well-known, industry-standard security and linting tools.
[COMMAND_EXECUTION]: The skill uses shell utilities (awk, grep, sed) and the docker CLI to perform static analysis and optional build tests on target Dockerfiles. This is the primary function of the skill and is executed through a defined script flow.
[PROMPT_INJECTION]: The skill processes external, untrusted content (Dockerfiles) which constitutes an indirect prompt injection surface. The risk is managed by using dedicated static analysis binaries rather than directly interpolating the file content into the agent's primary system instructions.
[SAFE]: The skill implements robust cleanup procedures via shell traps to remove temporary virtual environments and files after analysis, ensuring no persistent artifacts remain in the host environment.

dockerfile-validator