That seems pretty much impossible to accurately classify. Any container image that runs a server could be seen as malicious depending on the user