Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jrjsmrtn/project-orchestration-skills --skill setup-container-securitygit clone --depth 1 https://github.com/jrjsmrtn/project-orchestration-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jrjsmrtn/project-orchestration-skills/setup-container-security)<a href="https://agentmods.dev/skills/jrjsmrtn/project-orchestration-skills/setup-container-security"><img src="https://agentmods.dev/badge/skills/jrjsmrtn/project-orchestration-skills/setup-container-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jrjsmrtn/project-orchestration-skills/setup-container-security"><img src="https://agentmods.dev/badge/skills/jrjsmrtn/project-orchestration-skills/setup-container-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.02803 |
| Opus 5 | $0.00038 | $0.01401 |
| Sonnet 5 | $0.00015 | $0.00561 |
| Haiku 4.5 | $0.00008 | $0.00280 |
Grade C, and why
setup-container-security scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
Never `curl … | sh` an installer, and never fetch a binary/model with no checksum gate. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf /var/lib/apt/lists/* Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
A container bakes in a base image, fetched packages/binaries, and a runtime user. A mutable base tag can be repointed upstream; an unverified `curl … | install` can be swapped; a root runtime turns any escape into host-l How it starts
The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setup Container Security
Harden a project's container image against supply-chain attack: pin the base, verify what you fetch, drop privileges, and scan what you ship. OCI-compliant first — target the OCI image spec so the artifact runs on any conformant runtime (podman, Docker, containerd). Build and test distributable images with podman (rootless, daemonless, OCI output by default), and stay Docker-compatible (Dockerfile/Containerfile are interchangeable below).
When to Use
- When a project builds a container image (has a
Containerfile/Dockerfile) - Before publishing an image to a registry (a project that ships the image as a release artifact)
- When auditing container security, or when a supply-chain review flags container gaps
Required Inputs
- The project's
Containerfile/Dockerfile(s) - Base image(s) and target registry
- Whether the project publishes the image (ships it as a release artifact) — gates SBOM-as-release-asset + signing, delegated to
wrapup-sprint
The Threat
A container bakes in a base image, fetched packages/binaries, and a runtime user. A mutable base tag can be repointed upstream; an unverified curl … | install can be swapped; a root runtime turns any escape into host-level access. Hardening: pin, verify, minimize, drop privileges, scan.
Workflow
Step 1: Triage
ls Containerfile Dockerfile **/Dockerfile 2>/dev/null
# Mutable base tags (should be digest-pinned):
grep -nE '^FROM .*:[^@]*$' Containerfile Dockerfile 2>/dev/null
# Runs as root? (no USER, or USER root):
grep -nE '^USER ' Containerfile Dockerfile 2>/dev/null || echo "no USER — root unless the entrypoint drops privileges"
# Unverified fetch-and-install:
grep -nE 'curl.*\|\s*(sh|bash)|wget .*http' Containerfile Dockerfile 2>/dev/null
The recurring "looks fine at a glance" anti-pattern (a real-world example): a -slim base on a mutable tag, no USER (root runtime), and a build-time binary/model download with no checksum — despite otherwise-good habits (--no-install-recommends, a HEALTHCHECK, a .containerignore). It fails the three load-bearing checks: digest pinning, non-root, and artifact integrity.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 230 lines · 76 tokens per session scan C e17dd9ed1126
setup-container-security is a skill published in the GitHub repository jrjsmrtn/project-orchestration-skills (15 stars, last pushed 5d ago), licensed MIT. It adds 76 tokens to every session and 2,803 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 3 findings (downloads and executes remote code, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
env-provisioning
Provision a fast, reproducible dev environment for QA or standalone use — healthcheck-gated boot, reuse/teardown rules, host-mode fallback. Protocol for /orc:env, /orc:qa Phase 4, /orc:flow Phase 6, and the orc-env-provisioner agent.
c-jira
Manage Jira issues using jira (jira-cli). List and filter issues, create new tickets, transition issue status, manage sprints, and add comments — all from the terminal without opening a browser.
linear
Linear project management — issues, cycles, and projects via GraphQL API.
docker-best-practices
Docker expert — image optimization, security hardening, multi-stage builds, orchestration, production deployment. Use when writing or reviewing Dockerfiles, Compose, or container deploys.
pn-docker
Docker best practices for production containers. Multi-stage builds, non-root user, .dockerignore, layer caching, compose.yaml for local dev, and container security scanning. Use when writing or reviewing Dockerfiles or local development container setups.
redteam-container-detail-pack
Domain routing and boundary guidance for authorized container and orchestration security testing, including Docker escape, Kubernetes privilege escalation, image vulnerabilities, and service mesh bypasses. Use when a task belongs to the container testing domain and needs scope, evidence, pivot, or exit criteria.