Why this verdict
- suspicious: finding skill:skills/securing-container-registry-images:skills/securing-container-registry-images/SKILL.md:216:SUPPLY
- suspicious: finding skill:skills/securing-container-registry-images:skills/securing-container-registry-images/SKILL.md:51:EXEC
- suspicious: finding skill:skills/securing-container-registry-images:skills/securing-container-registry-images/SKILL.md:51:SUPPLY
- suspicious: finding skill:skills/securing-container-registry-images:skills/securing-container-registry-images/SKILL.md:53:EXEC
- suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:4a5201f1c27f9eae)
- suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:52b50800fe56dea6)
- suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:9f01fb049ea74dc1)
- suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:a631109436b7b759)
- suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:a67e3128532e6800)
- suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:bc01a76c8144a0b5)
Security findings 4
Code execution
criticalContextual riskmedium confidenceThe Prerequisites section instructs the agent to install Grype and Syft by piping install scripts fetched from unpinned main-branch raw.githubusercontent.com URLs directly into a shell, so executed code lives outside the pinned commit and can change without notice (Cosign is likewise installed via @latest).
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh
conceal:remotevector:instruction
Counter-argument considered
The curl|sh lines are Anchore's vendor-documented installers openly listed in the Prerequisites install section and declared verbatim as network capabilities D1 and D3, so the vendor-installer/declared-core-capability carve-out defeats the harm and the conceal:remote premise is factually wrong.
Code execution
criticalContextual riskmedium confidenceThe skill's prerequisites instruct the agent to install Syft by piping a shell script fetched from the unpinned main branch of raw.githubusercontent.com directly into sh, executing remote unpinned code on the host.
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh
conceal:remotevector:instruction
Counter-argument considered
The Syft line is Anchore's vendor-documented installer transparently listed in the Prerequisites install section and declared verbatim as capability D3, so the vendor-installer/declared-capability carve-out applies and the conceal:remote premise fails.
Supply chain
highContextual risklow confidenceThe CI/CD pipeline example pins the third-party aquasecurity/trivy-action GitHub Action to the mutable @master ref, so pipelines built from this instruction execute remote action code that can change without a pin.
uses: aquasecurity/trivy-action@master
conceal:remotevector:instruction
Counter-argument considered
The example concretely instructs agents to build CI workflows that execute aquasecurity/trivy-action@master at workflow run time, alongside COSIGN_PRIVATE_KEY; the mutable third-party action ref is covered by no declared claim (D1-D4 and the description cover tool installs and pipeline-building, not action pinning) and matches no carve-out since it is unpinned and is not a vendor installer command, so the finding stands.
Supply chain
highContextual risklow confidenceThe skill instructs the agent to install Grype and Syft by piping mutable raw.githubusercontent.com main-branch install scripts directly into sh and Cosign at @latest, executing remote code whose content is not pinned by this artifact (disclosed in prerequisites and repeated in agent.py's error message, so adjudicated contextual rather than concealed).
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh
conceal:remotevector:codevector:instruction
Counter-argument considered
The referenced scripts are Anchore's vendor installers transparently documented in the Prerequisites install section and declared verbatim as capabilities D1 and D3, so the carve-out applies; the residual concern is disclosed vendor install behavior, not concealed or undeclared code.
Open questions 1
What the analysis could not settle from the code alone.
The current content of the unpinned raw.githubusercontent.com main-branch install scripts and the @latest go module referenced by this skill lives outside the pinned commit and cannot be verified from the shown evidence.
Code execution
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Code execution
criticalRefutedlow confidenceThe SBOM generator's missing-tool handler prints an instruction telling the agent or user to execute a remote install script from Syft's unpinned main branch via curl piped into sh, which if followed runs remote code with user privileges.
Install: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh
Why it was refuted
agent.py never fetches or executes the remote script; on a missing Syft binary it only prints the same vendor-official installer command that declared capability D3 states verbatim, so the behavior falls under the vendor-installer/declared-core-capability carve-out and the instruction is declared, not concealed.
Supply chain
criticalRefutedlow confidenceThe prerequisites instruct installing Cosign via go install at the unpinned @latest version, so the binary that will later be built and executed is not fixed to any reviewable commit.
go install github.com/sigstore/cosign/v2/cmd/cosign@latest
Why it was refuted
go install of cosign at @latest is Sigstore's own documented install command, openly listed in the Prerequisites install section and declared verbatim as capability D2, so the vendor-installer/declared-capability carve-out applies and nothing is concealed or undeclared.
