analyzing-docker-container-forensics

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-docker-container-forensics/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands and scripts, but it is let down by weak progressive disclosure (bundle files are not referenced and their content is duplicated inline) and missing validation checkpoints in the evidence-handling workflow. Pointing to the bundle files and adding integrity-verification steps would substantially improve it.

Suggestions

Replace the inline full Python scripts and duplicated tool-syntax blocks with brief examples plus links to references/api-reference.md and scripts/agent.py to reduce duplication and improve progressive disclosure.

Add explicit validation checkpoints to the workflow (e.g. verify evidence tarball SHA-256 hashes match before analysis, confirm docker inspect/diff succeeded before proceeding, re-run failed scans with error handling).

Reference the bundle files explicitly in the body (e.g. 'See references/api-reference.md for full docker inspect JSON paths' and 'Run scripts/agent.py <container_id> for automated collection').

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with little concept-padding, but it embeds full inline Python scripts and tool-install commands that duplicate the logic already in scripts/agent.py, so it could be tightened.	3 / 5
Actionability	Provides copy-paste ready bash commands, complete Python analysis scripts, specific JSON paths, and named tools with exact flags, covering the common forensic scenarios comprehensively.	5 / 5
Workflow Clarity	Five steps are clearly sequenced, but there are no explicit validation checkpoints or error-recovery feedback loops for evidence-handling and batch operations; the destructive/batch cap of 3 applies.	3 / 5
Progressive Disclosure	Bundle files (references/api-reference.md, scripts/agent.py) exist, but the body never references or links them and instead inlines the API syntax and Python logic that those files already contain.	3 / 5
	Total	14 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and occupies a distinct niche, but it omits any explicit 'when to use' trigger guidance, which limits its completeness. Adding a 'Use when...' clause with natural trigger terms would raise both completeness and trigger-term quality.

Suggestions

Add an explicit 'Use when...' clause naming the situations that should trigger this skill (e.g. 'Use when investigating a compromised Docker container, a malicious image, or a container escape during incident response').

Include natural synonyms and variations a user might say, such as 'container forensics', 'docker breach', or 'container compromise', to improve trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (analyzing images, layers, volumes, logs, runtime artifacts) to identify malicious activity, giving comprehensive coverage of the container-forensics domain.	5 / 5
Completeness	The 'what' is clearly stated, but there is no explicit 'Use when...' trigger clause; per the guidelines a missing explicit trigger caps completeness at 3.	3 / 5
Trigger Term Quality	Natural keywords like 'compromised Docker containers' and 'malicious activity' are present, but common synonyms or extensions a user might say (e.g. 'container forensics', 'docker breach') are missing.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (compromised Docker container forensics) with distinct triggers, making overlap with other skills minimal.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-docker-container-forensics/SKILL.md
Commit: 54a7988

Reviewed: ~2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.