ops-docker — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ops-docker (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Docker Inc. publishes its own agent skills at docker/skills (Apache-2.0, pin v0.3.1). Four of them cover what this skill used to teach — multi-stage builds, non-root users, .dockerignore, HEALTHCHECK, BuildKit secrets and cache mounts, Compose healthchecks and depends_on: service_healthy:
| Skill | Use it when |
|---|---|
docker-project-foundations | Dockerizing a project, local dev with containers |
docker-build-strategies | Writing, slimming or hardening a Dockerfile |
docker-compose-patterns | Wiring services, adding a database, Compose debugging |
docker-destructive-guardrails | Before any docker command that deletes or resets state |
# pinned release (Docker's README documents the tree/<tag> form)
npx skills add https://github.com/docker/skills/tree/v0.3.1 --skill docker-project-foundations --yes
npx skills add https://github.com/docker/skills/tree/v0.3.1 --skill docker-build-strategies --yes
npx skills add https://github.com/docker/skills/tree/v0.3.1 --skill docker-compose-patterns --yes
npx skills add https://github.com/docker/skills/tree/v0.3.1 --skill docker-destructive-guardrails --yesThe repo's other seven skills (Docker Agent, Docker Sandboxes) are product-specific; install them only if you use those products. The three skills that ship a scripts/verify-*.sh only build the image and validate the Compose file.
Recipe entry: docs/recipes/recommended-vendor-skills.md §"Docker".
trivy image <image> (or Docker Scout, Grype) failing on HIGH/CRITICAL — the ops-ci skill wires it; qa-security owns the policy.hadolint Dockerfile as a blocking step, also absent from the vendor skills.COPY .env, no credentials in ENV or build args — BuildKit --mount=type=secret at build time, orchestrator-injected env at run time (.claude/rules/security.md)./ops:ops-deploy — deployment checklist consumes the built image/ops:ops-database — Compose patterns for DB servicesqa-security — image scanning gate before pushops-ci — Hadolint + image scan as CI steps~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.