{"data":{"skill":{"slug":"agentsecops-sca-trivy","name":"sca-trivy","icon":"📦","repo":"https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/sca-trivy","status":"approved","author":"AgentSecOps","authorVersion":"0.1.0","skillstoreRevision":2},"audit":{"id":"9b5b8ded-db35-43ba-81f4-9e1d5860f979","skill_id":"986e2f4a-2c86-42bf-89ca-273a9f1a633a","version":9,"content_hash":"v3:181fdefcafd96b041926e61c4b2e306ca7e7820e:967b8db690d6cf24c5c22e86663188e3080173e77084a57585efdceb1c867c25:d7ad82743949f55281e6e1924460d1f34227911b59679f66fba67740f5b5e795:736b696c6c732f6167656e747365636f70732f7363612d7472697679:6b44c8fcf7c8a49d6103e4154a432d37","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 73 static findings are false positives caused by Markdown code fences, inline code, reference links, and documented configuration paths. Semantic review found mutable CI references, credential exposure guidance, and an ineffective custom-policy gate. These examples require hardening before publication.","remediation":[{"issue":"GitHub Actions examples use mutable branch and version references.","severity":"high","suggestion":"Pin every action to a reviewed full commit SHA, use current supported releases, and automate controlled dependency updates."},{"issue":"Registry authentication examples expose passwords through environment variables and command arguments.","severity":"medium","suggestion":"Use credential helpers or password-stdin. Provide secrets through masked CI facilities, and remove command-line password examples."},{"issue":"The custom policy workflow can succeed without enforcing a vulnerability threshold.","severity":"medium","suggestion":"Use correct policy evaluation with an explicit nonzero exit threshold, then test the example against known failing and passing images."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":56,"line_start":39},{"file":"SKILL.md","line_end":64,"line_start":56},{"file":"SKILL.md","line_end":76,"line_start":64},{"file":"SKILL.md","line_end":88,"line_start":76},{"file":"SKILL.md","line_end":93,"line_start":88},{"file":"SKILL.md","line_end":101,"line_start":93},{"file":"SKILL.md","line_end":113,"line_start":101},{"file":"SKILL.md","line_end":124,"line_start":113},{"file":"SKILL.md","line_end":147,"line_start":124},{"file":"SKILL.md","line_end":151,"line_start":147},{"file":"SKILL.md","line_end":162,"line_start":151},{"file":"SKILL.md","line_end":164,"line_start":162},{"file":"SKILL.md","line_end":170,"line_start":164},{"file":"SKILL.md","line_end":179,"line_start":170},{"file":"SKILL.md","line_end":194,"line_start":179},{"file":"SKILL.md","line_end":223,"line_start":194},{"file":"SKILL.md","line_end":225,"line_start":223},{"file":"SKILL.md","line_end":226,"line_start":225},{"file":"SKILL.md","line_end":227,"line_start":226},{"file":"SKILL.md","line_end":228,"line_start":227},{"file":"SKILL.md","line_end":230,"line_start":228},{"file":"SKILL.md","line_end":232,"line_start":230},{"file":"SKILL.md","line_end":233,"line_start":232},{"file":"SKILL.md","line_end":234,"line_start":233},{"file":"SKILL.md","line_end":235,"line_start":234},{"file":"SKILL.md","line_end":237,"line_start":235},{"file":"SKILL.md","line_end":239,"line_start":237},{"file":"SKILL.md","line_end":240,"line_start":239},{"file":"SKILL.md","line_end":241,"line_start":240},{"file":"SKILL.md","line_end":242,"line_start":241},{"file":"SKILL.md","line_end":243,"line_start":242},{"file":"SKILL.md","line_end":251,"line_start":243},{"file":"SKILL.md","line_end":266,"line_start":251},{"file":"SKILL.md","line_end":272,"line_start":266},{"file":"SKILL.md","line_end":279,"line_start":272},{"file":"SKILL.md","line_end":285,"line_start":279},{"file":"SKILL.md","line_end":291,"line_start":285},{"file":"SKILL.md","line_end":302,"line_start":291},{"file":"SKILL.md","line_end":309,"line_start":302},{"file":"SKILL.md","line_end":315,"line_start":309},{"file":"SKILL.md","line_end":343,"line_start":315},{"file":"SKILL.md","line_end":344,"line_start":343},{"file":"SKILL.md","line_end":345,"line_start":344},{"file":"SKILL.md","line_end":347,"line_start":345},{"file":"SKILL.md","line_end":354,"line_start":347},{"file":"SKILL.md","line_end":355,"line_start":354},{"file":"SKILL.md","line_end":356,"line_start":355},{"file":"SKILL.md","line_end":357,"line_start":356},{"file":"SKILL.md","line_end":358,"line_start":357},{"file":"SKILL.md","line_end":369,"line_start":358}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":452,"line_start":452},{"file":"SKILL.md","line_end":453,"line_start":453},{"file":"SKILL.md","line_end":454,"line_start":454},{"file":"SKILL.md","line_end":455,"line_start":455},{"file":"SKILL.md","line_end":456,"line_start":456},{"file":"SKILL.md","line_end":457,"line_start":457}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":408,"line_start":408},{"file":"SKILL.md","line_end":81,"line_start":81}]}],"critical_findings":[],"high_findings":[{"title":"Mutable CI Action References","locations":[{"file":"SKILL.md","line_end":144,"line_start":132}],"confidence":0.98,"description":"The CI example uses mutable action references, including aquasecurity/trivy-action@master. A changed upstream ref could execute unreviewed code inside trusted CI.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The example directly uses a mutable master branch and mutable major-version action tags in a CI job."}],"medium_findings":[{"title":"Registry Credential Exposure Guidance","locations":[{"file":"SKILL.md","line_end":387,"line_start":381}],"confidence":0.96,"description":"Authentication guidance exports TRIVY_PASSWORD and passes --password pass. Real substitutions can leak through shell history, process inspection, logs, or CI traces.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The documented commands explicitly place a password in an environment variable and command-line argument, both common credential exposure paths."},{"title":"Ineffective Custom Policy Gate","locations":[{"file":"SKILL.md","line_end":308,"line_start":300}],"confidence":0.93,"description":"The policy example labels --ignore-policy as enforcement but omits a failing exit code. Pipelines may report success while unacceptable findings remain.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The shown command filters with an ignore policy and provides no nonzero exit threshold, despite claiming to deny vulnerable images."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":458,"audit_model":"codex","audited_at":"2026-07-23T06:59:47.802+00:00","created_at":"2026-07-24T04:57:09.132772+00:00","static_findings":[{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":56,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":64,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"[ ] 2. Run comprehensive Trivy scan with `trivy image <image-name>`","category":"external_commands","line_end":76,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":88,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":93,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Consult `references/remediation_guide.md` for language-specific guidance","category":"external_commands","line_end":101,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":113,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":124,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":147,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":151,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":162,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":164,"severity":"medium","line_start":162},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use bundled templates from `assets/ci_integration/` for additional platforms.","category":"external_commands","line_end":170,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":179,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":194,"severity":"medium","line_start":179},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Secret scanning**: Enable with `--scanners secret` to detect exposed credentials in images","category":"external_commands","line_end":223,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### Scripts (`scripts/`)","category":"external_commands","line_end":225,"severity":"medium","line_start":223},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `trivy_scan.py` - Comprehensive scanning with JSON/SARIF output and severity filtering","category":"external_commands","line_end":226,"severity":"medium","line_start":225},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `sbom_generator.py` - SBOM generation with CycloneDX and SPDX format support","category":"external_commands","line_end":227,"severity":"medium","line_start":226},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `vulnerability_report.py` - Parse Trivy output and generate remediation reports with CVSS scores","category":"external_commands","line_end":228,"severity":"medium","line_start":227},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `baseline_manager.py` - Baseline creation for tracking new vulnerabilities only","category":"external_commands","line_end":230,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### References (`references/`)","category":"external_commands","line_end":232,"severity":"medium","line_start":230},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `scanner_types.md` - Detailed guide for vulnerability, misconfiguration, secret, and license scann","category":"external_commands","line_end":233,"severity":"medium","line_start":232},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `remediation_guide.md` - Language and ecosystem-specific remediation strategies","category":"external_commands","line_end":234,"severity":"medium","line_start":233},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `cvss_prioritization.md` - CVSS score interpretation and vulnerability prioritization framework","category":"external_commands","line_end":235,"severity":"medium","line_start":234},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `iac_checks.md` - Complete list of IaC security checks with CIS benchmark mappings","category":"external_commands","line_end":237,"severity":"medium","line_start":235},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### Assets (`assets/`)","category":"external_commands","line_end":239,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `trivy.yaml` - Custom Trivy configuration with security policies and ignore rules","category":"external_commands","line_end":240,"severity":"medium","line_start":239},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ci_integration/github-actions.yml` - Complete GitHub Actions workflow with security gates","category":"external_commands","line_end":241,"severity":"medium","line_start":240},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ci_integration/gitlab-ci.yml` - Complete GitLab CI pipeline with dependency scanning","category":"external_commands","line_end":242,"severity":"medium","line_start":241},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ci_integration/jenkins.groovy` - Jenkins pipeline with Trivy integration","category":"external_commands","line_end":243,"severity":"medium","line_start":242},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `policy_template.rego` - OPA policy template for custom vulnerability policies","category":"external_commands","line_end":251,"severity":"medium","line_start":243},{"id":"external_commands:SKILL.md:251:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":266,"severity":"medium","line_start":251},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":272,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:272:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":279,"severity":"medium","line_start":272},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":285,"severity":"medium","line_start":279},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":291,"severity":"medium","line_start":285},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":302,"severity":"medium","line_start":291},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":309,"severity":"medium","line_start":302},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":315,"severity":"medium","line_start":309},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **GitHub Actions**: Native `aquasecurity/trivy-action` with SARIF upload to Security tab","category":"external_commands","line_end":343,"severity":"medium","line_start":315},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Use `.trivyignore` file to suppress specific CVEs with justification","category":"external_commands","line_end":344,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Filter by exploitability: `trivy image --ignore-unfixed myapp:latest`","category":"external_commands","line_end":345,"severity":"medium","line_start":344},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Apply severity filtering: `--severity CRITICAL,HIGH`","category":"external_commands","line_end":347,"severity":"medium","line_start":345},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. See `references/false_positives.md` for common patterns","category":"external_commands","line_end":354,"severity":"medium","line_start":347},{"id":"external_commands:SKILL.md:354:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Use cached DB: `trivy image --cache-dir /path/to/cache myapp:latest`","category":"external_commands","line_end":355,"severity":"medium","line_start":354},{"id":"external_commands:SKILL.md:355:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Skip unnecessary scanners: `--scanners vuln` (exclude config, secret)","category":"external_commands","line_end":356,"severity":"medium","line_start":355},{"id":"external_commands:SKILL.md:356:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Use offline mode after initial DB download: `--offline-scan`","category":"external_commands","line_end":357,"severity":"medium","line_start":356},{"id":"external_commands:SKILL.md:357:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. Increase timeout: `--timeout 30m`","category":"external_commands","line_end":358,"severity":"medium","line_start":357},{"id":"external_commands:SKILL.md:358:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. Scan specific layers: `--removed-pkgs` to exclude removed packages","category":"external_commands","line_end":369,"severity":"medium","line_start":358},{"id":"external_commands:SKILL.md:369:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. Consult `references/scanner_types.md` for language-specific requirements","category":"external_commands","line_end":376,"severity":"medium","line_start":369},{"id":"external_commands:SKILL.md:376:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":388,"severity":"medium","line_start":376},{"id":"external_commands:SKILL.md:388:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":394,"severity":"medium","line_start":388},{"id":"external_commands:SKILL.md:394:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Create `trivy.yaml` configuration file:","category":"external_commands","line_end":396,"severity":"medium","line_start":394},{"id":"external_commands:SKILL.md:396:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":416,"severity":"medium","line_start":396},{"id":"external_commands:SKILL.md:416:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":418,"severity":"medium","line_start":416},{"id":"external_commands:SKILL.md:418:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use with: `trivy image --config trivy.yaml myapp:latest`","category":"external_commands","line_end":422,"severity":"medium","line_start":418},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Create `.trivyignore` to suppress specific CVEs:","category":"external_commands","line_end":424,"severity":"medium","line_start":422},{"id":"external_commands:SKILL.md:424:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":434,"severity":"medium","line_start":424},{"id":"external_commands:SKILL.md:434:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":440,"severity":"medium","line_start":434},{"id":"external_commands:SKILL.md:440:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":448,"severity":"medium","line_start":440},{"id":"network:SKILL.md:20:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://aquasecurity.github.io/trivy/","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:SKILL.md:21:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://owasp.org/www-project-dependency-check/","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://nvd.nist.gov/","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:23:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://www.cisa.gov/sbom","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:SKILL.md:452:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Trivy Official Documentation](https://aquasecurity.github.io/trivy/)","category":"network","line_end":452,"severity":"low","line_start":452},{"id":"network:SKILL.md:453:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [OWASP Dependency Check](https://owasp.org/www-project-dependency-check/)","category":"network","line_end":453,"severity":"low","line_start":453},{"id":"network:SKILL.md:454:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [NVD - National Vulnerability Database](https://nvd.nist.gov/)","category":"network","line_end":454,"severity":"low","line_start":454},{"id":"network:SKILL.md:455:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [CISA SBOM Guidelines](https://www.cisa.gov/sbom)","category":"network","line_end":455,"severity":"low","line_start":455},{"id":"network:SKILL.md:456:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [CWE-1104: Use of Unmaintained Third-Party Components](https://cwe.mitre.org/data/definitions/1104","category":"network","line_end":456,"severity":"low","line_start":456},{"id":"network:SKILL.md:457:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [OWASP Top 10 - Vulnerable and Outdated Components](https://owasp.org/Top10/)","category":"network","line_end":457,"severity":"low","line_start":457},{"id":"filesystem:SKILL.md:408:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"dir: /tmp/trivy-cache","category":"filesystem","line_end":408,"severity":"medium","line_start":408},{"id":"filesystem:SKILL.md:81:hard-link-creation","file":"SKILL.md","pattern":"Hard link creation","snippet":"trivy fs --scanners vuln package-lock.json","category":"filesystem","line_end":81,"severity":"medium","line_start":81}],"finding_verdicts":[{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:251:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:272:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:354:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:355:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:356:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:357:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:358:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:369:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:376:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:388:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:394:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:396:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:416:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:418:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:424:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:434:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:440:ruby-shell-backtick-execution","reason":"The cited text is Markdown documentation using fenced or inline code. It contains no Ruby backtick operator or executable implementation, so this location cannot invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:20:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:21:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:22:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:23:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:452:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:453:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:454:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:455:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:456:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:457:hardcoded-url","reason":"The URL is a documentation or standards reference in Markdown. No HTTP client, automatic fetch, credential transfer, or data exfiltration occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:408:temp-directory-access","reason":"This is a fixed cache path inside a non-executable YAML example. SKILL.md does not create or write the directory, so the detected filesystem access is absent.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:81:hard-link-creation","reason":"The line is a Trivy command that scans package-lock.json; it does not invoke ln or create any link. The hard-link creation pattern is not present.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Mutable CI Action References","severity":"high","locations":[{"file":"SKILL.md","line_end":144,"line_start":132}],"confidence":0.98,"description":"The CI example uses mutable action references, including aquasecurity/trivy-action@master. A changed upstream ref could execute unreviewed code inside trusted CI.","confidence_reasoning":"The example directly uses a mutable master branch and mutable major-version action tags in a CI job."},{"title":"Registry Credential Exposure Guidance","severity":"medium","locations":[{"file":"SKILL.md","line_end":387,"line_start":381}],"confidence":0.96,"description":"Authentication guidance exports TRIVY_PASSWORD and passes --password pass. Real substitutions can leak through shell history, process inspection, logs, or CI traces.","confidence_reasoning":"The documented commands explicitly place a password in an environment variable and command-line argument, both common credential exposure paths."},{"title":"Ineffective Custom Policy Gate","severity":"medium","locations":[{"file":"SKILL.md","line_end":308,"line_start":300}],"confidence":0.93,"description":"The policy example labels --ignore-policy as enforcement but omits a failing exit code. Pipelines may report success while unacceptable findings remain.","confidence_reasoning":"The shown command filters with an ignore policy and provides no nonzero exit threshold, despite claiming to deny vulnerable images."}],"subject_marketplace_commit_sha":"181fdefcafd96b041926e61c4b2e306ca7e7820e","subject_content_hash":"967b8db690d6cf24c5c22e86663188e3080173e77084a57585efdceb1c867c25","subject_tree_hash":"d7ad82743949f55281e6e1924460d1f34227911b59679f66fba67740f5b5e795","subject_plugin_path":"skills/agentsecops/sca-trivy","audit_payload_hash":"6b44c8fcf7c8a49d6103e4154a432d37","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"181fdefcafd96b041926e61c4b2e306ca7e7820e","contentHash":"967b8db690d6cf24c5c22e86663188e3080173e77084a57585efdceb1c867c25","treeHash":"d7ad82743949f55281e6e1924460d1f34227911b59679f66fba67740f5b5e795","pluginPath":"skills/agentsecops/sca-trivy","auditPayloadHash":"6b44c8fcf7c8a49d6103e4154a432d37"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/agentsecops-sca-trivy/audits/9/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}