container-security-hardening

79 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.

By sinhoneyy/master-skills (GitHub) · coding · 17 stars · scanned at commit 8e70b78

Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls. Use for Dockerfile security reviews, container CVEs, image scanning, distroless images, or production hardening.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 16 places.

skills/container-security-hardening/SKILL.md, line 46find . -name "Dockerfile*" -not -path "*/node_modules/*" | head -10
skills/container-security-hardening/SKILL.md, line 184docker pull node:20-slim
skills/container-security-hardening/SKILL.md, line 217docker history --no-trunc myapp:latest | grep -iE "secret|key|password|token"

Show 13 more

skills/container-security-hardening/SKILL.md, line 301brew install trivy # macOS
skills/container-security-hardening/SKILL.md, line 343tmpdir="$(mktemp -d)"
skills/container-security-hardening/SKILL.md, line 368docker run --rm -i hadolint/hadolint < Dockerfile
skills/container-security-hardening/SKILL.md, line 389trivy image --scanners secret myapp:latest
skills/container-security-hardening/SKILL.md, line 444docker run \
skills/container-security-hardening/SKILL.md, line 532docker run --security-opt seccomp=unconfined \
skills/container-security-hardening/SKILL.md, line 552sudo apparmor_parser -r /etc/apparmor.d/docker-default
skills/container-security-hardening/SKILL.md, line 569brew install cosign # macOS
skills/container-security-hardening/SKILL.md, line 609syft myapp:latest -o cyclonedx-json > sbom.json
skills/container-security-hardening/SKILL.md, line 635aws ecr put-registry-scanning-configuration \
skills/container-security-hardening/SKILL.md, line 742kubectl label namespace production \
skills/container-security-hardening/SKILL.md, line 850kubectl auth can-i --list --as=system:serviceaccount:production:myapp-sa
skills/container-security-hardening/references/base-image-comparison.md, line 127docker run -it --rm -v $(pwd):/app node:20-alpine sh -c "cd /app && npm ci && npm test"

Sends data to these websites: api.example.com, raw.githubusercontent.com

This is disclosed by the author in the skill's SKILL.md or README.

Found in 6 places.

skills/container-security-hardening/SKILL.md, line 203RUN curl -H "Authorization: Bearer $TOKEN" https://api.example.com > config.json
skills/container-security-hardening/SKILL.md, line 209curl -H "Authorization: Bearer $(cat /run/secrets/api_token)" \
skills/container-security-hardening/SKILL.md, line 305curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \

Show 3 more

skills/container-security-hardening/SKILL.md, line 345curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh \
skills/container-security-hardening/SKILL.md, line 459--health-cmd "curl -f http://localhost:3000/health || exit 1" \
skills/container-security-hardening/SKILL.md, line 929| Secret in `docker history` | `ENV` or `RUN curl -H "Bearer $TOKEN"` | Use `RUN --mount=type=secret` |

Downloads and installs other software

The author does not mention this.

Found in 5 places.

skills/container-security-hardening/SKILL.md, line 301brew install trivy # macOS
skills/container-security-hardening/SKILL.md, line 302apt install trivy # Debian/Ubuntu
skills/container-security-hardening/SKILL.md, line 569brew install cosign # macOS

Show 2 more

skills/container-security-hardening/references/base-image-comparison.md, line 150apt-get install -y --no-install-recommends \
skills/container-security-hardening/references/base-image-comparison.md, line 234- [ ] `npm ci --only=production` / `pip install --no-dev`?

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Other copies in this repository

sinhoneyy/master-skills has 1 more folder with a skill named container-security-hardening. This page shows the lowest-scoring copy.

plugins/master-skills-security-engineer/skills/container-security-hardening 79/100 · Review before installing

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'container-security-hardening' ] || [ -L ~/.agents/skills/'container-security-hardening' ]; then echo 'A skill folder named container-security-hardening already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/sinhoneyy/master-skills' "$d" && git -C "$d" checkout --quiet '8e70b780359915a1f197ca37a1add2d4016115a2' -- 'skills/container-security-hardening' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/container-security-hardening' ~/.agents/skills/'container-security-hardening' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'container-security-hardening' ~/.claude/skills/'container-security-hardening' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for sinhoneyy/master-skills shows the score of its lowest-scoring skill.

SkillTrust badge for sinhoneyy/master-skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/sinhoneyy/master-skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/sinhoneyy/master-skills/)

Score history

Date	Version	Score
2026-11-09	`8e70b78`	79