Statically audit Dockerfiles to identify and mitigate security risks before container deployment.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install dockerfile-hardening-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install dockerfile-hardening-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Dockerfile Hardening Audit?
The Dockerfile Hardening Audit tool is a specialized component within the Openclaw Skills ecosystem designed to enforce security best practices. It statically analyzes Dockerfiles to detect vulnerabilities such as the absence of a non-root USER, unpinned base images, and dangerous use of the ADD instruction. This skill helps developers maintain a high standard of security by scoring files based on their risk level.
By integrating this tool into your development workflow, you leverage Openclaw Skills to automate the discovery of container hardening gaps. It provides clear, actionable feedback, ensuring that your production images are built on a secure foundation and follow modern containerization standards.
Dockerfile Hardening Audit Use Cases
- Auditing CI/CD pipelines for insecure Dockerfile patterns.
- Automating security reviews for container-based microservices.
- Preventing the use of floating tags and unpinned base images in development.
- Ensuring compliance with non-root user execution standards.
- Validating container healthcheck implementation across a repository.
How Dockerfile Hardening Audit Works
- The skill scans for files matching the specified DOCKERFILE_GLOB pattern within your project directory.
- It applies a series of hardening rules to each detected file, evaluating parameters like USER declarations, HEALTHCHECK presence, and image tagging.
- A risk score is calculated for each Dockerfile based on the severity of the detected violations.
- The tool generates a report in text or JSON format, ranking files by their security risk level.
- Optional fail-gate logic triggers a non-zero exit code if critical security issues are found, preventing insecure builds.
Dockerfile Hardening Audit Setup
To use this tool within the Openclaw Skills framework, run the audit script using bash. You can customize the scan via environment variables.
# Run a basic report
DOCKERFILE_GLOB='**/Dockerfile*' \
bash skills/dockerfile-hardening-audit/scripts/dockerfile-hardening-audit.sh
# Run with JSON output and a failure gate for critical risks
DOCKERFILE_GLOB='**/Dockerfile*' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/dockerfile-hardening-audit/scripts/dockerfile-hardening-audit.sh
Dockerfile Hardening Audit Data Schema & Taxonomy
The skill accepts various configuration inputs to tune the audit sensitivity. The output follows a structured format for easy interpretation.
| Input Variable | Default | Description |
|---|---|---|
| DOCKERFILE_GLOB | **/Dockerfile* |
Glob pattern to locate Dockerfiles |
| WARN_SCORE | 3 |
Score threshold to flag a warning |
| CRITICAL_SCORE | 6 |
Score threshold to flag a critical risk |
| REQUIRE_NON_ROOT_USER | 1 |
Enforce presence of non-root USER |
| REQUIRE_HEALTHCHECK | 1 |
Enforce presence of HEALTHCHECK instruction |
| FAIL_ON_CRITICAL | 0 |
Exit with code 1 if critical issues are found |
| OUTPUT_FORMAT | text |
Choose between 'text' or 'json' reports |
Dockerfile Hardening Audit Advanced Features
- Customizable risk scoring allows for tailoring audits to specific security policies.
- Regex-based inclusion (FILE_MATCH) and exclusion (FILE_EXCLUDE) filters for granular file targeting.
- Automated detection of risky shell piping like curl|bash and wget|sh.
- Flagging of unpinned base images and floating tags to ensure build reproducibility.
- Seamless integration into multi-agent workflows within Openclaw Skills for comprehensive repository analysis.
SKILL.md
Loading
Related Openclaw Skills
CI Flake Triage
A powerful utility for identifying and prioritizing flaky tests by analyzing JUnit retry artifacts within your CI pipeline.
McDonald's China MCP Order Lite
A streamlined MCP-based skill for automating McDonald's China delivery orders, menu lookups, and coupon management via official API protocols.
Perpetua
A hosted OAuth proxy that enables seamless data retrieval from Oura Ring and Google Calendar using a single master API key.
Calendar Bridge
A self-hosted Node.js service that provides a persistent REST API for Google Calendar with automated OAuth token refreshing.
Env Alias Audit
A robust auditing tool to detect environment variable alias conflicts and missing required configurations before deployment.
GitHub Actions Actor Reliability Audit
An automated auditing tool that ranks GitHub Actions reliability by identifying high-risk contributors and flaky automation owners through run history analysis.
METADATA
Featured*
