Dockerfile Analyzer

This skill failed 3 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.

• No undeclared network calls: failed

  Contacts 1 host that is neither well-known infrastructure nor declared in the skill's frontmatter: patrykgolabek.dev.

  Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.

  Hosts contacted

  patrykgolabek.devundeclared

  What it found

  • skills/dockerfile-analyzer/hooks/validate-dockerfile.sh:326contacts patrykgolabek.dev

    echo "Fix these issues to improve security and reliability. See https://patrykgolabek.dev/tools/dockerfile-analyzer/ for full analysis."

• No credential access: failed

  Touches credential material in 1 place.

  Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.

  What it found

  • skills/dockerfile-analyzer/SKILL.md:164instructs the agent to access ssh private keys or config(in the instructions, not code)

    - **Check:** COPY or ADD instructions targeting sensitive files (.env, id_rsa, .pem, .key, credentials, etc.)

• No pipe-to-shell installers: failed

  Runs code fetched at install time in 3 places.

  No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.

  What it found

  • skills/dockerfile-analyzer/SKILL.md:156tells the user to run: remote script piped into a shell(in the instructions, not code)

    - **Check:** RUN instructions piping curl/wget output to sh/bash/zsh (e.g., `curl ... | bash`)

  • skills/dockerfile-analyzer/SKILL.md:159tells the user to run: remote script piped into a shell(in the instructions, not code)

    - **Before:** `RUN curl -sSL https://example.com/install.sh | bash`

  • skills/dockerfile-analyzer/SKILL.md:199tells the user to run: remote script piped into a shell(in the instructions, not code)

    - **Before:** `FROM node:22-bookworm\nRUN curl -fsSL https://bun.sh/install | bash\nCMD ["node", "server.js"]`

• Declares what it does: passed

  SKILL.md parses and declares a name and a description.

  SKILL.md exists, its frontmatter parses, and it declares a name and a description.

• No obfuscated payloads: passed

  No encoded or obfuscated payloads.

  No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.

• Pinned to a commit: passed

  Scanned patrykquantumnomad/patrykquantumnomad at 0b2f850882.

  The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit

0b2f850882

Manifest

skills/dockerfile-analyzer/SKILL.md

Scanned

2 files, 861 lines