Repair Docker BuildKit Cache Secret Layer Leak

Leaking secrets in Docker layers via BuildKit cache is a common CI/CD vulnerability that puts production credentials at risk. This skill investigates exposed secrets caused by incorrect cache boundaries and prepares bounded remediation plans. ## What it does - **Inspect build arguments** to identify hardcoded secrets or misconfigured secret mounts. - **Verify layer provenance** to determine where and when a secret was cached. - **Map layer history** to visualize how sensitive data propagates across branches and builds. - **Register exposure exceptions** by documenting specific layers that require purging. - **Plan clean builds** with specific validation gates to ensure no secrets persist in future runs. ## How it works 1. Provide the agent with your Dockerfile, build logs, and layer history snapshots. 2. The agent executes an evidence-led procedure to crosscheck timestamps and identifiers. 3. It classifies every finding as Verified, Contradicted, Unverified, or Not Applicable. 4. It outputs a structured evidence map and a recovery plan for your approval. ## Frameworks & tools Docker BuildKit, CI/CD pipelines (GitHub Actions, GitLab CI), and container registry metadata. ## Why this beats prompting it yourself Generic prompts often miss the nuances of BuildKit's layer caching, leading to "false negatives" where secrets remain in parent layers. This skill enforces strict decision discipline, separating hard observations from inferences and citing exact timestamps for every conclusion. ## Use cases - Auditing a CI pipeline after a secret was accidentally committed to a build argument. - Investigating why a supposedly "clean" build still contains legacy environment variables. - Preparing a remediation plan for a security team following a BuildKit cache leak. ## Known limitations Requires local text-based build logs and configuration files. It cannot interact directly with cloud registries or live build servers to pull new metadata.