skills/mukul975/anthropic-cybersecurity-skills/securing-container-registry-with-harbor/Gen Agent Trust Hub
securing-container-registry-with-harbor
Fail
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: Hardcoded credentials
admin:Harbor12345are found inSKILL.md(multiple curl examples) andscripts/agent.py(line 144). The inclusion of default administrative passwords in documentation and script defaults can lead to insecure deployments. - [COMMAND_EXECUTION]: Multiple components of the skill deliberately bypass SSL certificate verification. In
SKILL.md, severalcurlcommands use the-k(insecure) flag. Inscripts/process.py, the SSL context is configured withctx.verify_mode = ssl.CERT_NONEandctx.check_hostname = False. These practices leave the agent and the registry management operations vulnerable to Man-in-the-Middle (MitM) attacks. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of Harbor from the official Helm repository at
https://helm.getharbor.io. This is a well-known service for Harbor deployment and is documented here as a necessary external dependency.
Recommendations
- AI detected serious security threats
Audit Metadata