Versioned security assessment

Report ID: SA-9E952417

7/23/2026, 5:11:47 AM

container-grype security assessment v9

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
container-grype
Version
v0.1.0
Maintainer
AgentSecOps
Source
github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/container-grype
Coverage
11 Files scanned · 3,469 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

Critical

7 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static matches are false positives caused by Markdown formatting, defensive examples, and normal Grype configuration. Confirmed risks include unpinned pipe-to-shell installers, Docker socket exposure, and unquoted Tekton parameters that permit command injection. Semantic review also found bypassable security gates, broad ignore rules, and mutable CI dependencies.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

11 Files scanned · 3,469 Lines analyzed

13 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 2 evidence locations

Network access

May connect to external services.

Observed in 29 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 18 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (6)
High
assets/grype-ci-config.yml:369
Shell command substitution
grype $(params.IMAGE) \
Tekton substitutes the user-supplied IMAGE parameter directly into an unquoted shell command. Shell metacharacters in the parameter can inject commands into the task.
High
assets/grype-ci-config.yml:370
Shell command substitution
--fail-on $(params.SEVERITY_THRESHOLD) \
Tekton substitutes the severity parameter directly into an unquoted shell command. A crafted parameter value can alter arguments or inject additional shell commands.
High
assets/grype-ci-config.yml:373
Shell command substitution
grype $(params.IMAGE) -o table | tee /workspace/grype-report.txt
The user-supplied IMAGE parameter is expanded unquoted in a second shell pipeline. This repeats the command-injection path in the report-generation command.
Low
assets/ci-config-template.yml:240
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
This URL is used to download an installer that is immediately executed. The mutable upstream script creates a supply-chain exposure even though the domain is legitimate.
Low
assets/grype-ci-config.yml:205
Hardcoded URL
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/
This URL supplies executable installer content from a mutable main branch. Its direct use in CI creates a real external supply-chain dependency.
Low
assets/grype-ci-config.yml:269
Hardcoded URL
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/
This URL supplies executable installer content from a mutable main branch. Its direct use in CI creates a real external supply-chain dependency.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (7)

RISK-001 Critical
assets/ci-config-template.yml:240
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The template pipes an unpinned remote installer directly into bash. A compromised branch, repository, or connection endpoint would gain code execution in the CI runner.
RISK-002 Critical
assets/grype-ci-config.yml:205
Pipe to shell pattern
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/
The CircleCI example streams an unpinned main-branch installer into a shell. Upstream compromise or an unexpected change would execute with runner permissions.
RISK-003 Critical
assets/grype-ci-config.yml:269
Pipe to shell pattern
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/
The Azure Pipelines example streams an unpinned main-branch installer into a shell. Upstream compromise or an unexpected change would execute with runner permissions.
RISK-004 Critical
assets/grype-ci-config.yml:140
Docker socket access
args '-v /var/run/docker.sock:/var/run/docker.sock'
The Jenkins container mounts the host Docker socket. Code in that container can control the Docker daemon and commonly obtain host-level access.
RISK-005 High
assets/ci-config-template.yml:125-140assets/ci-config-template.yml:228-256
Security gates can pass without enforcing findings
Node audit output is never evaluated, and the IaC stage converts scanner failures into warnings. Vulnerable builds can pass despite the template presenting these checks as gates.
The Node command is followed by no result check, while the IaC block uses || true and leaves exit 1 commented out.
RISK-006 High
assets/ci-config-template.yml:196-202assets/grype-ci-config.yml:121-140assets/grype-ci-config.yml:364-373
CI examples execute mutable action and image references
The templates use a GitHub Action from master and Grype container images tagged latest. Future upstream changes can execute without repository review or digest verification.
The files explicitly reference aquasecurity/trivy-action@master, set GRYPE_VERSION to latest, and run anchore/grype:latest.
RISK-007 Medium
assets/grype-config.yaml:11-38
Example configuration suppresses broad vulnerability classes
The bundled Grype configuration ignores every wont-fix vulnerability and all matches for a named package. Copying it can hide real findings without expiry or target-specific justification.
The active ignore rules include fix-state: wont-fix and a package-only pytest match, both broader than the example-specific CVE suppressions.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installers are piped directly into shell interpreters.
    Download a versioned release, verify its published checksum or signature, and execute only the verified local file.
  2. FIX-002
    Critical
    The Jenkins example exposes the host Docker socket to the scanner container.
    Scan a registry image or SBOM without the socket, or use an isolated rootless builder with narrowly scoped access.
  3. FIX-003
    High
    Tekton parameters are inserted into shell commands without quoting or validation.
    Pass parameters through environment variables, quote every expansion, and validate image references and severity values against strict allowlists.
  4. FIX-004
    High
    CI examples use mutable action branches and latest container tags.
    Pin actions to reviewed commit SHAs and container images to immutable digests or exact release versions.
  5. FIX-005
    High
    Some scanner failures and findings do not fail the pipeline.
    Remove unconditional success handling, parse every scanner result, and enforce documented severity thresholds before deployment.
  6. FIX-006
    Medium
    The example Grype configuration contains broad active ignore rules.
    Comment out sample ignores and require exact CVE, package, justification, owner, and expiration details for every suppression.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
Content hash
4064e3c28098dbcefe40f3f317088b3b5bdfb5e675bd1174dee97055dc337064
Tree hash
013ce566078989f332e0b1fccf3ac27054fd9f889c65cd4a3319b3271b5fffca
Skill path
skills/agentsecops/container-grype
Audit payload hash
62f919abbb736e106a7614d6f87c7dd6

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active