Why this verdict
- suspicious: finding skill:skills/securing-helm-chart-deployments:skills/securing-helm-chart-deployments/SKILL.md:276:SUPPLY
- suspicious: finding skill:skills/securing-helm-chart-deployments:skills/securing-helm-chart-deployments/SKILL.md:277:SUPPLY
Security findings 2
Supply chain
mediumContextual riskmedium confidenceThe CI pipeline the skill instructs users to create pins third-party GitHub Actions to the mutable @master ref, so the code executed in CI (with access to chart signing) can change without notice.
uses: aquasecurity/trivy-action@master
vector:instruction
Counter-argument considered
The quote is exact: the skill-body workflow example instructs executing a third-party action at the mutable @master branch, which no carve-out covers (it is not a pinned registry install or a vendor installer in install docs), and no declared claim or mitigation addresses pinning CI actions, so the contextual supply-chain risk stands.
Supply chain
mediumContextual risklow confidenceThe example CI pipeline instructs use of third-party GitHub Actions pinned to the mutable @master ref, steering unpinned remote workflow code execution in the user's CI.
uses: aquasecurity/trivy-action@master
vector:instruction
Counter-argument considered
Same evidence as the trivy step: the example workflow steers execution of third-party workflow code at a mutable @master ref; this is undeclared by any claim and carved out by nothing, so the low-severity contextual risk stands (it overlaps the line-276 finding).
Open questions 1
What the analysis could not settle from the code alone.
The frontmatter description routes rendered-manifest scanning away from this skill ('Do not use for scanning the rendered manifests themselves'), yet the skill's own scripts render and scan rendered.yaml (agent.py render_templates/scan_with_kubesec, process.py scan_rendered) and its docs run kubesec/checkov/trivy/kube-linter on rendered.yaml; confirm whether this scope mismatch is intentional dedup or a misstatement of the skill's actual behavior.
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Supply chain
highRefutedmedium confidenceThe skill instructs running `helm plugin install https://github.com/jkroepke/helm-secrets`, fetching unpinned plugin code from a mutable GitHub URL that later executes during helm-secrets commands; the plugin is declared, but the unversioned remote fetch is an undeclared-pinning supply-chain risk.
helm plugin install https://github.com/jkroepke/helm-secrets
Why it was refuted
The line sits in a fenced install-doc block ('# Install helm-secrets plugin') that installs the helm-secrets plugin from its vendor's canonical repository via Helm's official plugin installer, matching the vendor-installers-in-fenced-install-docs carve-out; moreover the plugin's use is itself a declared claim, so the undeclared-pinning harm does not survive.
Supply chain
highRefutedmedium confidenceThe skill instructs the agent to install the helm-secrets plugin from an unpinned GitHub URL, fetching mutable remote code that will execute during subsequent Helm secret operations.
helm plugin install https://github.com/jkroepke/helm-secrets
Why it was refuted
Duplicate of the line-204 observation: the fenced install-doc block uses the vendor's (jkroepke/helm-secrets) official installer path, which is a carve-out, and the artifact itself declares the helm-secrets plugin as a recommended mechanism, so the finding is neutralized.
