Skill

scanning-container-images-with-grype

skill:mukul975/anthropic-cybersecurity-skills#scanning-container-images-with-grype

Scans container images, filesystems, and SBOMs for known CVEs with Anchore Grype, matching Syft-generated SBOM packages against NVD, GitHub Advisories, and OS-specific feeds with configurable severity thresholds and failure gates. Use when Grype or Syft is the chosen toolchain, when scanning an existing SBOM rather than an image, or when gating a build on severity. Keywords: Grype, Syft, SBOM, NVD, GitHub Advisory, --fail-on, severity threshold. Do not use when the toolchain is Trivy - use scanning-docker-images-with-trivy.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:51 UTC at 54a7988

findings

critical

highest severity

threat classes

4,532

files scanned

172/172

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/scanning-container-images-with-grype:skills/scanning-container-images-with-grype/SKILL.md:52:EXEC
suspicious: finding skill:skills/scanning-container-images-with-grype:skills/scanning-container-images-with-grype/SKILL.md:52:SUPPLY
suspicious: finding skill:skills/scanning-container-images-with-grype:skills/scanning-container-images-with-grype/SKILL.md:62:EXEC
suspicious: finding skill:skills/scanning-container-images-with-grype:skills/scanning-container-images-with-grype/SKILL.md:62:SUPPLY
suspicious: finding skill:skills/scanning-container-images-with-grype:skills/scanning-container-images-with-grype/references/workflows.md:11:EXEC
suspicious: finding skill:skills/scanning-container-images-with-grype:skills/scanning-container-images-with-grype/references/workflows.md:8:EXEC
suspicious: finding skill:skills/scanning-container-images-with-grype:skills/scanning-container-images-with-grype/references/workflows.md:8:SUPPLY
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:2c024399381559cb)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:48ddbce59d9c0ef4)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:4a53fed2e44e3a1e)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:4ee272055924ddb8)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:5af90df7d9f61619)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:65394be66e1fd146)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:7f499d0511202a47)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:b00af69c688330af)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:b618028e2d97ae14)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:be914b25b82ab35e)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:cb853b52ff92ed03)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:f279fcd149e7e05f)

Security findings 7

Code execution

criticalContextual risklow confidence

The workflows reference instructs the agent to install Syft by piping the install script from the mutable main branch of raw.githubusercontent.com into sh, executing unpinned remote code on the host; this is the official vendor installer shown in fenced installation docs, so it is a contextual risk rather than confirmed abuse.

skills/scanning-container-images-with-grype/references/workflows.md:11

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

conceal:remotevector:instruction

Counter-argument considered

The Syft instruction is the official Anchore vendor installer inside a fenced environment-setup block, installing a Syft CLI that the skill's Prerequisites explicitly declare, so it is declared vendor-tooling setup rather than undeclared or concealed harm.

Code execution

criticalContextual risklow confidence

The workflows reference instructs the agent to install Grype by piping the install script from the mutable main branch of raw.githubusercontent.com into sh, executing unpinned remote code on the host; this is the official vendor installer shown in fenced installation docs, so it is a contextual risk rather than confirmed abuse.

skills/scanning-container-images-with-grype/references/workflows.md:8

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

conceal:remotevector:instruction

Counter-argument considered

Line 8 repeats the exact install command declared in D1 for the official Anchore vendor installer, inside a fenced environment-setup block, so it is declared vendor-tooling documentation rather than undeclared remote execution.

Code execution

criticalContextual risklow confidence

The skill's Prerequisites section instructs the agent to install Grype by piping the install script from the mutable main branch of raw.githubusercontent.com directly into sh, executing unpinned remote code on the host; this is the official Anchore vendor installer shown in fenced docs, so it is a contextual risk rather than confirmed abuse.

skills/scanning-container-images-with-grype/SKILL.md:52

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

conceal:remotevector:instruction

Counter-argument considered

The command is the official Anchore vendor installer from the vendor's own repository, openly documented in the skill's Prerequisites and explicitly declared as the skill's network capability claim D1, so it falls under the vendor-installer/declared-capability carve-outs rather than being undeclared or concealed harm.

Code execution

criticalContextual risklow confidence

The skill's Install Grype section instructs the agent to pipe the Anchore install script from the mutable main branch of raw.githubusercontent.com into sh, executing unpinned remote code on the host; this is the official vendor installer shown in fenced installation docs, so it is a contextual risk rather than confirmed abuse.

skills/scanning-container-images-with-grype/SKILL.md:62

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

conceal:remotevector:instruction

Counter-argument considered

The fenced Install Grype section documents the official Anchore vendor installer verbatim (alongside a brew install grype alternative), and the identical fetch is declared as capability claim D1, so this is vendor-installer documentation, not undeclared or concealed abuse.

Supply chain

highContextual risklow confidence

The workflow reference instructs the agent to fetch and pipe into sh both the Grype (line 8) and Syft (line 11) installers from the unpinned main branch of raw.githubusercontent.com, executing remote code outside the pinned commit during the documented environment-setup phase.

skills/scanning-container-images-with-grype/references/workflows.md:8

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

conceal:remotevector:instruction

Counter-argument considered

Both installers are the official Anchore vendor install scripts shown in fenced setup blocks for the skill's declared Grype/Syft toolchain; the Grype fetch is identical to declared claim D1, so the documented setup is declared and carved out, not concealed supply harm.

Supply chain

highContextual risklow confidence

The skill's Prerequisites section (undeclared residue R1, an unexplained capability: the declared scanning purpose needs Grype installed but not via unpinned remote code) instructs the agent to pipe the Grype install script fetched from the mutable main branch of raw.githubusercontent.com directly into sh, executing whatever content sits at that URL at runtime, outside the pinned commit.

skills/scanning-container-images-with-grype/SKILL.md:52

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

conceal:remotevector:instruction

Counter-argument considered

The 'undeclared residue' premise is contradicted by declared claim D1, which declares exactly this fetch-and-install command as the skill's network capability, and the installer is the official Anchore vendor installer documented in the skill's own install docs, a listed carve-out.

Supply chain

highContextual risklow confidence

The skill's Install Grype section instructs the agent to fetch the Anchore Grype installer from the unpinned main branch and pipe it into sh as a prerequisite setup step, so remote unpinned code is executed on the host if the agent follows the documented setup.

skills/scanning-container-images-with-grype/SKILL.md:62

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

conceal:remotevector:instruction

Counter-argument considered

The unpinned-fetch behavior at line 62 is the same command declared in D1 and is the official Anchore vendor installer shown in fenced install docs (with a Homebrew alternative offered), so the setup behavior is declared vendor tooling, not concealed supply harm.

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedlow confidence

When the grype binary is missing, agent.py returns an error string instructing the agent to run an unpinned curl-pipe-to-sh installer from raw.githubusercontent.com, embedding a remote fetch-and-execute instruction in tool output that the agent may follow.

skills/scanning-container-images-with-grype/scripts/agent.py:35

Install: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh

Why it was refuted

The FileNotFoundError message points to the same official Anchore vendor installer whose fetch the skill declares as capability claim D1, so it is declared toolchain setup surfaced in an error path, not concealed remote-code abuse.

Supply chain

criticalRefutedlow confidence

The scanner script embeds the same unpinned curl-pipe-to-sh Grype install command in its FileNotFoundError error message, instructing the agent to fetch and execute remote code from the mutable main branch whenever grype is missing.

skills/scanning-container-images-with-grype/scripts/agent.py:35

grype not found. Install: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh

Why it was refuted

The embedded install instruction is the vendor's official installer command for the skill's declared tool, matching the fetch declared in D1, so it is declared prerequisite guidance rather than undeclared supply-chain abuse.