SkillSpector · pentest-tools
independent scanner by NVIDIA · skill by zhaoxuya520 · how it works ↗
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.; Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.; Potential security issue detected. Manual review is recommended.; +5 more
scanned 2026-08-22
Findings (20)
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
SKILL.md
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
SKILL.md
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
SKILL.md
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
SKILL.md
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
SKILL.md
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
SKILL.md
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
references/awesome-pentest-digest.md
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
references/awesome-pentest-digest.md
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
references/awesome-pentest-digest.md
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
references/network-attack-defense.md
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
references/network-attack-defense.md
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
references/network-attack-defense.md
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
references/network-attack-defense.md
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
references/network-attack-defense.md
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
references/network-attack-defense.md
Potential security issue detected. Manual review is recommended.
references/network-attack-defense.md
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
references/web-attack-cheatsheet.md
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
references/web-attack-cheatsheet.md
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
references/web-attack-cheatsheet.md
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
references/web-attack-cheatsheet.md
What the verdicts mean
SkillSpector reports on SkillMD's shared five-tier scale. See how SkillSpector works ↗.
Overall severity LOW (risk score in the safe range)
Overall severity MEDIUM
Overall severity HIGH
Overall severity CRITICAL
Scan could not complete