BC container-security-hardening

• low Dangerous commands cmd-privilege references/detailed-guide.md:420
  Privilege escalation / world-writable permissions (code comment; documentation of a security skill)

  --security-opt no-new-privileges:true \    # Prevent privilege escalation via setuid

  commentsecurity skill
• low Risky intent intent-offensive-security references/detailed-guide.md:420
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  --security-opt no-new-privileges:true \    # Prevent privilege escalation via setuid

• low Dangerous commands cmd-privilege references/detailed-guide.md:441
  Privilege escalation / world-writable permissions (documentation table row; documentation of a security skill)

  | `SETUID` / `SETGID` | Switch user identity | No — drop always |

  tablesecurity skill
• low Exfiltration net-credential-use references/detailed-guide.md:901
  Credential used in a network call (verify the destination is the intended service) (documentation table row; documentation of a security skill)

  | Secret in `docker history` | `ENV` or `RUN curl -H "Bearer $TOKEN"` | Use `RUN --mount=type=secret` |

  tablesecurity skill
• low Risky intent intent-offensive-security SKILL.md:88
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Do not treat the output as a substitute for environment-specific penetration testing or a formal security audit.

A further 1 matches are quotations in this security skill's documentation and are not counted as findings.