MoltDocker

Enables the bot to manage Docker containers, images, and stacks.

This skill appears to do what it says (manage Docker), but there are practical and security gaps you should address before installing: - Verify the runtime: the SKILL.md expects the docker CLI and access to Docker daemon (e.g., /var/run/docker.sock). Confirm whether your agent environment actually provides Docker and whether the socket is exposed. Access to the Docker daemon is equivalent to root on the host — treat it as highly sensitive. - Ask the skill author (or registry) to fix the metadata inconsistency (declare docker as a required binary) and to document whether it intends to use a local Docker socket or a remote/limited API. - Restrict where this skill runs: if possible, run it in an isolated sandbox or against a remote Docker endpoint with least privilege rather than exposing the host Docker socket. - Consider disabling autonomous invocation or require explicit user confirmations for destructive operations (rm, rmi, system prune) — the SKILL.md already recommends this but enforce it in the agent config. - Be cautious about logs/inspect output: container logs and inspect can contain secrets or private data. Treat any data the skill returns as potentially sensitive. If you can't confirm the environment and the author, test the skill in a disposable VM/container first or decline installation.

Type: OpenClaw Skill Name: moltbot-docker Version: 1.0.0 The skill requests access to the `docker` binary, a powerful tool that, when executed, often operates with elevated privileges (e.g., as root or in the docker group). While the `SKILL.md` instructions list legitimate Docker management commands and even include safety rules for destructive actions, the inherent capability to execute arbitrary `docker` commands (including `docker inspect` which can reveal sensitive container configurations) represents a significant risk. This falls under 'risky capabilities without clear malicious intent' as it provides a powerful attack surface for potential privilege escalation or host compromise if the agent or the underlying Docker daemon is exploited, even though the skill itself does not explicitly instruct malicious behavior.