analyzing-docker-container-forensics

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-docker-container-forensics/SKILL.md

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is highly actionable with executable commands and a clear five-step forensic workflow, but it is padded with a concepts table Claude does not need, lacks explicit validation feedback loops, and fails to route readers to the existing reference and script bundle files. Linking the bundle and trimming redundant explanation would lift the weaker dimensions.

Suggestions

Replace or trim the 'Key Concepts' table entries that restate well-known Docker concepts (overlay2, Docker socket, container escape); keep only forensics-specific nuance.

Add explicit validation checkpoints between steps (e.g. verify evidence hashes match before analysis, confirm docker export succeeded before extracting), forming a validate→fix→retry loop.

Reference the bundle files from the body — point detailed syntax to references/api-reference.md and automation to scripts/agent.py — so the overview stays lean and the API content is not duplicated inline.

Dimension	Reasoning	Score
Conciseness	The bulk is lean executable commands that earn their place, but the 'Key Concepts' table restates concepts Claude already knows (overlay2, Docker socket, container escape), placing it at 'mostly efficient but includes some unnecessary explanation'; not a 3 because of that redundant explanation, not a 1 because the core is not padded prose.	2 / 3
Actionability	Provides fully executable bash and embedded Python that is copy-paste ready with real flags and paths, matching the 'fully executable code/commands' anchor; not a 2 because nothing here is pseudocode or missing key details.	3 / 3
Workflow Clarity	Five clearly sequenced steps with evidence hashing provide a sequence, but there are no explicit validate→fix→retry feedback loops for the batch/destructive evidence operations, which the rubric caps at 2; not a 1 because sequencing and integrity hashing are present.	2 / 3
Progressive Disclosure	The bundle provides references/api-reference.md and scripts/agent.py, but the body never signals or links to them and keeps API usage inline that belongs in the reference, matching the 'references present but not clearly signaled; content that should be separate is inline' anchor; not a 1 because the body itself is sectioned and organized.	2 / 3
	Total	9 / 12 Passed

Description

82%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, uses natural trigger terms, and occupies a distinct niche, but it lacks an explicit 'Use when...' clause so the use-when guidance is only implied rather than stated. Adding a trigger clause would raise completeness from 2 to 3.

Suggestions

Append an explicit trigger clause, e.g. 'Use when investigating a compromised Docker container or container host, analyzing a suspicious image, or responding to a containerized application breach.'

Include common phrasings a user might say such as 'container forensics' or 'incident response' to broaden natural-keyword coverage.

Keep the current concrete action list intact — it is the strongest part of the description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'analyzing images, layers, volumes, logs, and runtime artifacts' — matching the 'multiple specific concrete actions' anchor rather than the single-action anchor at 2.	3 / 3
Completeness	Clearly states what it does but omits any 'Use when...' trigger clause, so the 'when' is only implied; the judging guidelines cap completeness at 2 in this case, and it is not a 1 because the 'what' is strong.	2 / 3
Trigger Term Quality	Uses natural terms a user would say — 'compromised Docker containers', 'malicious activity', 'images, layers, volumes, logs' — with good coverage, above the 'some relevant keywords' level at 2.	3 / 3
Distinctiveness Conflict Risk	Targets a clear niche (compromised Docker container forensics) with distinct triggers unlikely to overlap with other skills, matching the 'clear niche' anchor; not a 2 because it is not merely 'somewhat specific'.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-docker-container-forensics/SKILL.md
Commit: e612f49

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.