dockerfile-gen
Warn
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Execution of
npx ai-dockerfileinvolves downloading a package from the npm registry at runtime. - [REMOTE_CODE_EXECUTION]: The skill uses
npxto download and execute code from an external registry. The packageai-dockerfileis not associated with a verified trusted organization. - [COMMAND_EXECUTION]: The skill requires the execution of shell commands (
npx) on the host system to perform its primary function of project scanning and Dockerfile generation. - [PROMPT_INJECTION]: The skill scans local project files to generate Dockerfiles, creating an indirect prompt injection surface.
- Ingestion points: Local project files scanned by the tool during analysis.
- Boundary markers: None identified in the skill instructions to separate project data from agent instructions.
- Capability inventory: Shell command execution via
npxand potential local file system writes. - Sanitization: No evidence of input validation or sanitization for the scanned project contents.
Audit Metadata