Versioned security assessment

Report ID: SA-7DC67F71

7/5/2026, 1:47:17 AM

api-spectral security assessment v7

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: api-spectral
Version: v7
Maintainer: AgentSecOps
Source: github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/api-spectral
Coverage: 9 Files scanned · 3,739 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Critical

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static detections are false positives from Markdown examples, Spectral rule templates, and defensive security references. The actionable risk is supply-chain exposure in CI templates that download remote content from branch URLs, including a curl-to-bash installer. No prompt injection language was found in the reviewed skill files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

9 Files scanned · 3,739 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 2 evidence locations

Network access

May connect to external services.

Observed in 25 evidence locations

Filesystem access

May read or write local files.

Observed in 7 evidence locations

Env variables

May read values from the process environment.

Observed in 18 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 113 evidence locations

Capability review items (3)

Critical

assets/ci-config-template.yml:240

Hardcoded URL

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The CI template downloads an installer from a mutable GitHub URL and pipes it to bash on line 240. A changed or compromised upstream script would execute arbitrary code in the runner.

High

assets/github-actions-template.yml:66

Hardcoded URL

https://raw.githubusercontent.com/SecOpsAgentKit/skills/main/appsec/api-spectral/scripts/parse_spect

The workflow downloads a Python parser from a mutable raw GitHub URL and then executes it in the same job. That creates unpinned remote code execution in CI.

Medium

assets/github-actions-template.yml:165

Hardcoded URL

https://raw.githubusercontent.com/SecOpsAgentKit/skills/main/appsec/api-spectral/assets/spectral-owa

The workflow downloads a ruleset from a mutable branch URL during CI. It is not a script, but a changed ruleset can weaken security gates or alter validation behavior.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Critical

assets/ci-config-template.yml:240

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The line uses a curl-to-bash install pattern inside a reusable CI template. This is a real supply-chain execution risk because no version pinning or integrity check is present.

RISK-002 High

assets/ci-config-template.yml:237-240 assets/github-actions-template.yml:63-70 assets/github-actions-template.yml:163-166

Unpinned Remote Downloads in CI Templates

Reusable workflow templates download scripts or rulesets from mutable raw GitHub branch URLs. One template also pipes a remote installer directly to bash, creating CI supply-chain exposure.

The templates explicitly download remote content during CI, and the parser script is executed later in the job. The tfsec installer is piped to bash with no pinning or checksum, so the supply-chain risk is clear.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
Critical
Remote installer piped to shell in the CI template.

Replace the curl-to-bash tfsec install with a pinned action, package manager install, or checksum-verified release artifact.
FIX-002
High
Workflow templates download raw GitHub files from mutable branch URLs.

Vendor helper scripts and rulesets, or pin immutable commit URLs with checksum verification before execution.
FIX-003
Medium
Reusable CI examples need clearer production hardening guidance.

Add comments requiring review of workflow permissions, token scope, downloaded tool versions, and artifact retention.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)

High

references/EXAMPLE.md:276

C2 keywords

- **T1041**: Exfiltration Over C2 Channel

Force-confirmed blocker/high static finding; AI dismissal overridden.

High

references/WORKFLOW_CHECKLIST.md:193

Malware type keywords

[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)

Force-confirmed blocker/high static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable