Why this verdict
- suspicious: finding skill:skills/performing-cloud-asset-inventory-with-cartography:skills/performing-cloud-asset-inventory-with-cartography/SKILL.md:220:SUPPLY
Security findings 1
Supply chain
mediumContextual risklow confidenceUndeclared for the declared sync/inventory purpose: the skill's Docker Compose deployment documentation instructs pulling the cartography container image by the mutable 'latest' tag rather than a pinned version, allowing silent upstream code changes in what gets deployed.
image: ghcr.io/cartography-cncf/cartography:latest
vector:instruction
Counter-argument considered
Attempted refutation fails: the pinned official-registry carve-out does not apply because the official image reference is explicitly mutable (:latest), and no mitigation or digest pin exists anywhere in the shown units, so the mutable-tag supply risk stands as a genuine, if low-severity, undeclared deployment behavior with a concrete instruction the agent would apply.
Open questions 1
What the analysis could not settle from the code alone.
[file request skills/performing-cloud-asset-inventory-with-cartography/scripts/agent.py] Show lines 1-62 (imports, query_neo4j, inventory_ec2_instances) of agent.py to confirm there are no network-capable imports or additional sinks beyond the Neo4j driver in the portion of the file not served with this request.
Data exfiltration
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Persistence
criticalRefutedmedium confidenceThe skill documentation instructs adding a crontab entry that runs the cartography binary every six hours, persisting scheduled execution of the sync tool on the host; the scheduled payload is the declared tool itself, so intent appears benign but the persistence capability is real.
# Add to crontab - sync every 6 hours
Why it was refuted
The crontab instruction schedules the declared cartography binary with its declared Neo4j sync flags, so this is the declared core capability (running Cartography to sync cloud resources into Neo4j) executed openly on a timer, not a persistence payload; the PERSIST harm collapses under the declared-core-capability carve-out despite being a concrete instruction the agent could act on.
