Audit History

Most static matches are false positives caused by Markdown formatting, defensive examples, and normal Grype configuration. Confirmed risks include unpinned pipe-to-shell installers, Docker socket exposure, and unquoted Tekton parameters that permit command injection. Semantic review also found bypassable security gates, broad ignore rules, and mutable CI dependencies.

Most static findings are false positives from Markdown examples, reference material, and CI syntax. Confirmed risks are limited to the bundled CI templates. They include pipe-to-shell installers, Docker socket mounting, token exposure, unquoted Tekton parameters, and an unpinned action.

Most static findings are false positives caused by Markdown examples, reference material, or CI variable syntax. Real risks remain in bundled CI templates: remote installer scripts are piped into shells, a Jenkins example mounts the Docker socket, one token is exposed to action code, and Tekton parameters are used unquoted in shell commands.

Static analysis found many command, network, filesystem, environment, and script patterns, but most are documentation examples for legitimate vulnerability scanning workflows. The confirmed risks are operational: some CI templates install tools with curl piped to a shell and one Jenkins example mounts the Docker socket, so publication is acceptable only with clear warnings and review guidance.

Documentation-only skill containing markdown files and YAML configuration templates for the open-source Grype vulnerability scanner. All 332 static findings are false positives - the scanner flagged shell command examples (177), URL references (45), and environment variable patterns (27) in documentation as security issues. No executable code exists. This skill provides documentation and workflows for container vulnerability scanning but performs no actual scanning, network access, or file system operations beyond reading its own documentation files.

Documentation-only skill containing markdown files and YAML configuration templates for the open-source Grype vulnerability scanner. All 332 static findings are false positives - the scanner flagged shell command examples (177), URL references (45), and environment variable patterns (27) in documentation as security issues. No executable code exists. This skill provides documentation and workflows for container vulnerability scanning but performs no actual scanning, network access, or file system operations beyond reading its own documentation files.

Documentation-only skill with no executable code. Contains only markdown documentation and YAML configuration templates for the open-source Grype vulnerability scanner. No scripts, network calls, or file system access beyond its own documentation files.

Documentation-only skill with no executable code. Contains only markdown documentation and YAML configuration templates for the open-source Grype vulnerability scanner. No scripts, network calls, or file system access beyond its own documentation files.

Documentation-only skill with no executable code. Contains only markdown documentation and YAML configuration templates for the open-source Grype vulnerability scanner. No scripts, network calls, or file system access beyond its own documentation files.