Skill

scanning-iac-and-images-with-trivy

skill:mukul975/anthropic-cybersecurity-skills#scanning-iac-and-images-with-trivy

Scans container images, Infrastructure-as-Code (Terraform, CloudFormation, Kubernetes manifests, Dockerfile, Helm), filesystems, git repos, and SBOMs with Trivy's vuln, misconfig, secret, and license scanners. Use when building a CI/CD security gate that scans images before push, IaC before apply, or SBOMs for supply-chain weaknesses, and fails the build on policy violations.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:47 UTC at 54a7988

findings

critical

highest severity

threat classes

4,532

files scanned

94/94

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/scanning-iac-and-images-with-trivy:skills/scanning-iac-and-images-with-trivy/SKILL.md:216:SUPPLY
suspicious: finding skill:skills/scanning-iac-and-images-with-trivy:skills/scanning-iac-and-images-with-trivy/SKILL.md:67:EXEC
suspicious: finding skill:skills/scanning-iac-and-images-with-trivy:skills/scanning-iac-and-images-with-trivy/SKILL.md:70:SUPPLY
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:5069564061036731)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:53c06dc76a561fcb)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:93904a0c83928a5f)

Security findings 3

Code execution

criticalContextual riskhigh confidence

The Prerequisites section instructs the agent to pipe the unpinned main-branch contrib/install.sh from raw.githubusercontent.com into sudo sh, executing mutable remote code with root privileges whose behavior lives outside the pinned commit.

skills/scanning-iac-and-images-with-trivy/SKILL.md:67

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin

conceal:remotevector:instruction

Counter-argument considered

contrib/install.sh is the vendor's (Aqua Security's) official installer invoked by its documented curl|sh method inside a fenced code block of the Prerequisites installation docs; the vendor-installers-in-fenced-install-docs carve-out carries no pinning condition, so the harm gate fails even though the raw.githubusercontent.com fetch is undeclared residue.

Supply chain

highContextual risklow confidence

The CI/CD gate examples pin the official Trivy GitHub Action to the mutable @master ref instead of a version or commit SHA, so the action code executed in the pipeline can change without notice.

skills/scanning-iac-and-images-with-trivy/SKILL.md:216

uses: aquasecurity/trivy-action@master

conceal:remotevector:instruction

Counter-argument considered

The kill case fails: the 'pinned official-registry installs' carve-out requires a pin, @master is mutable, the CI-gate wiring is only the declared capability while the unpinned ref is the harm, and no shown claim or mitigation covers the ref. The accurate supply-chain finding stands.

Supply chain

mediumContextual risklow confidence

The containerized usage example runs the unpinned latest tag of the aquasec/trivy image with the host Docker socket mounted, tying scan execution to mutable remote code with daemon-level access.

skills/scanning-iac-and-images-with-trivy/SKILL.md:70

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:latest image python:3.10-alpine

vector:instruction

Counter-argument considered

The kill case fails: the official-registry carve-out requires pinning and :latest is unpinned, a container run is runtime execution rather than a vendor installer in install docs, and no shown claim or mitigation covers the mutable tag, so the accurate supply finding stands.

Open questions 1

What the analysis could not settle from the code alone.

The install script executed as root via `curl ... | sudo sh` is served from the mutable URL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh and is not part of the pinned commit; its runtime content cannot be verified from the artifact.

Code execution

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Persistence

criticalRefutedmedium confidence

SKILL.md instructs the agent to install a GPG key into /usr/share/keyrings and write a permanent APT repository entry via `sudo tee /etc/apt/sources.list.d/trivy.list`, persistently modifying the host package-manager configuration outside the workspace.

skills/scanning-iac-and-images-with-trivy/SKILL.md:61

sudo tee /etc/apt/sources.list.d/trivy.list

Why it was refuted

The APT keyring and sources.list.d setup is Aqua Security's official vendor install procedure, openly labeled and fenced inside the Prerequisites installation docs, which matches the vendor-installers-in-fenced-install-docs carve-out (and serves the declared core capability), so the harm gate fails and the persistence framing does not survive.

Privilege escalation

highRefutedlow confidence

SKILL.md instructs the agent to run the unpinned aquasec/trivy:latest container with the host /var/run/docker.sock mounted in, granting that container root-equivalent control of the host Docker daemon.

skills/scanning-iac-and-images-with-trivy/SKILL.md:70

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:latest image python:3.10-alpine

Why it was refuted

The socket mount is the vendor-documented mechanism for the declared core capability of scanning container images via containerized Trivy, declared in the artifact itself ('Docker (optional) if scanning local images by name or using the containerized Trivy.'), so the privilege grant is the declared core capability plus a broad permission inherent to it, and the PRIVESC claim is carved out at the harm gate.