What problem does it solve? Container configurations often ship with serious security flaws — images running as root, mutable :latest base tags, secrets baked into layers, and exposed Docker sockets — that go unnoticed until deployment. This Skill statically audits Dockerfile, Containerfile, and docker-compose files as code, catching these defects before they reach production without requiring Docker, a daemon, or network access. ## Core Features & Use Cases - Six-dimension security scoring: Evaluates base image pinning (K1), privilege and runtime hardening (K2), secret and build-context hygiene (K3), image minimalism (K4), known CVEs via Trivy/Grype (K5), and compose orchestration hardening (K6), producing a HEALTHY to CRITICAL grade with critical gates. - Static-first, CI-safe operation: Parses Dockerfiles and compose files (including override merges) with zero Docker and zero network; the CVE scan runs only when Trivy or Grype is present and degrades to N/A otherwise. - Safety gates: Read-only operation, automatic secret value censorship in reports, and explicit consent before any image pull. - Use Case: Before shipping a Dockerized service, run the audit to discover that your final stage lacks a USER directive and your compose file mounts /var/run/docker.sock, then receive a prioritized remediation roadmap with file:line citations. ## Quick Start Ask the AI to run a container security audit on the current project and report the score, critical findings, and remediation steps.
