writing-dockerfiles
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: CRITICAL
Full Analysis
- Command Execution (SAFE): The analyze_image_size.sh script utilizes standard Docker CLI tools to extract image metadata. This is consistent with the skill's primary purpose and does not involve risky parameter expansion or unquoted variables.
- Indirect Prompt Injection (SAFE): The validate_dockerfile.py script processes untrusted Dockerfile content. While this presents an ingestion surface for indirect prompt injection, the script's logic is limited to non-executable regex parsing, which safely identifies best-practice violations without triggering code execution.
- Metadata Poisoning (SAFE): The outputs.yaml file contains configuration for various development environments. No malicious instructions or deceptive metadata were found in these definitions.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata