Dockerfile Scan

Dockerfile Security Scan

Parses a Dockerfile and flags common security and supply-chain problems, each with a concrete fix. Pure text analysis — no Docker daemon, no network, stdlib only.

When to use this skill

• "Review this Dockerfile for security issues."
• "Is my container running as root?"
• "Lint my Dockerfiles before I push them."

What it checks

• Base image pinning — missing tag or :latest (docker-no-tag,

docker-latest-tag).

• Runs as root — no USER, or final USER is root (docker-root-user).
• Remote code execution — curl|wget … | sh (docker-remote-exec).
• Remote ADD — ADD http://… without integrity checks

(docker-add-remote).

• Hardcoded secrets — ENV/ARG with a secret-looking name and a value

(docker-hardcoded-secret).

• Loose permissions — chmod 777 (docker-chmod-777).
• sudo usage in RUN (docker-sudo).

How to run it

# Scan one Dockerfile
python skills/dockerfile-scan/scanner.py path/to/Dockerfile

# Scan every Dockerfile under a directory, as JSON
python skills/dockerfile-scan/scanner.py . --json

Exit codes: 0 clean · 1 findings present · 2 usage/IO error.

Recommended workflow for Claude

1. Run the scan on the file or repo.
2. Present findings by severity, each with its one-line fix.
3. Offer a corrected Dockerfile snippet (pinned base image, non-root USER,

COPY instead of remote ADD, secrets moved to runtime).

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: NovaCode37
• Source: NovaCode37/claude-security-skills
• License: MIT

Install and usage instructions live in the source repository linked above.