Automatically generate optimized Dockerfiles for various app types with multi-stage builds and best practice performance enhancements.

This skill appears coherent and low-risk: it only generates Dockerfile text. Before using results in production, manually review generated Dockerfiles for security best practices (avoid embedding secrets, pin exact base-image versions, add a non-root user, minimize exposed ports and installed packages, and validate multi-stage build outputs). Because it's instruction-only, it won't fetch code or credentials on its own, but never paste secrets into prompts or files you ask it to containerize.

Type: OpenClaw Skill Name: dockerfile-generator Version: 1.0.0 The skill is designed to generate Dockerfiles, but the `skill.yaml` implementation in JavaScript directly embeds user-provided `config.version` and `config.port` values into the Dockerfile string without sanitization. This creates a Dockerfile injection vulnerability, allowing an attacker to inject arbitrary commands into the generated Dockerfile if they can control these configuration parameters. While this is a critical vulnerability (potential RCE during Docker build), there is no clear evidence of intentional malicious behavior such as data exfiltration or self-exploitation within the provided code, classifying it as suspicious rather than malicious.