docker

Optimizes Dockerfiles and Docker Compose for Python and Node.js applications, enhancing container performance and reliability.

Install this skill

55/100

Security score

The docker skill was audited on May 12, 2026 and we found 11 security issues across 3 threat categories, including 1 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 228

Template literal with variable interpolation in command context

SourceSKILL.md

228

```yaml

high line 356

Template literal with variable interpolation in command context

SourceSKILL.md

356	- Secrets in `environment:` as plaintext — environment variables are visible in `docker inspect`, CI logs, and image layers if baked in; use Docker secrets, a secrets manager, or pass via host env

medium line 135

Access to root home directory

SourceSKILL.md

135	RUN --mount=type=cache,target=/root/.cache/uv \

low line 101

Access to .env file

SourceSKILL.md

101

**/.env

low line 102

Access to .env file

SourceSKILL.md

102

**/.env.*

low line 239

Access to .env file

SourceSKILL.md

239	# Option 3: .env file (dev only — don't commit secrets)

low line 241

Access to .env file

SourceSKILL.md

241

- .env

medium line 357

Access to .env file

SourceSKILL.md

357	- No `.dockerignore` — without it, `COPY . .` sends the entire repo (`.git`, `node_modules`, `__pycache__`, `.env`) into the build context, bloating image size and potentially leaking secrets

medium line 364

Access to .env file

SourceSKILL.md