Skills sast-horusec

📦

sast-horusec

Name: sast-horusec
Author: AgentSecOps

v0.1.0 Content revision r2 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts

Scan Code with Horusec

Security flaws and exposed secrets can cross language boundaries and reach production. This skill guides Horusec scans, result triage, and CI integration.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "sast-horusec" from https://skillstore.io/skills/agentsecops-sast-horusec.md and its manifest at https://skillstore.io/api/skills/agentsecops-sast-horusec/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-sast-horusec.md Signed manifest GET /api/skills/agentsecops-sast-horusec/manifest Signed lockfile GET /api/skills/agentsecops-sast-horusec/lockfile

Test it

Using "sast-horusec". Scan this Python service and prioritize the results.

Expected outcome:

Critical: one exposed credential requires immediate rotation and history cleanup.
High: two injection paths require parameterized database queries.
Next step: remediate confirmed findings, document accepted risks, and rescan.

Using "sast-horusec". Plan Horusec integration for pull requests.

Expected outcome:

Run scans on pull requests with pinned dependencies and minimal permissions.
Store restricted reports for thirty days and redact sensitive snippets.
Block merges on confirmed critical or high findings after validated parsing.

Using "sast-horusec". Reduce false positives without hiding risk.

Expected outcome:

Validate each candidate against source context and exploitability.
Record accepted hashes with owner, rationale, review date, and expiration.
Reassess exclusions after rule updates or major application changes.

Security Audit

Critical

v9 • 7/23/2026 Open versioned report

Most detections are documentation syntax, secure examples, or reference URLs and are false positives. Confirmed risks include remote installers, Docker socket exposure, unsafe permissions, token exposure, mutable images, and ineffective CI gates.

Files scanned

1,886

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (7)

Critical

assets/ci-config-template.yml:240

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The template downloads a mutable remote script and executes it without integrity verification. A compromised source can run arbitrary CI code.

Critical

SKILL.md:298

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/ZupIT/horusec/main/deployments/scripts/install.sh | bas

The installation command pipes an unverified remote script directly into Bash. A compromised branch or account could execute arbitrary code.

Critical

SKILL.md:39

Docker socket access

docker run -v /var/run/docker.sock:/var/run/docker.sock \

The command gives a mutable Horusec container direct Docker socket access. Container compromise can control sibling containers and the host.

Critical

SKILL.md:213

Docker socket access

docker run -v /var/run/docker.sock:/var/run/docker.sock \

The CI example gives a mutable Horusec container direct Docker socket access. Image compromise can control the runner host.

Critical

SKILL.md:256

Docker socket access

sudo chmod 666 /var/run/docker.sock

World-writable Docker socket permissions let any local process control Docker. This commonly provides effective root-level host access.

Critical

SKILL.md:39-40 SKILL.md:213-214

Mutable privileged container dependency

The guide runs mutable Horusec images with the host Docker socket, allowing a compromised image to control the host.

Both examples combine a latest image tag with direct host Docker socket access.

High

assets/ci-config-template.yml:34 assets/ci-config-template.yml:246-256

Declared CI thresholds are not enforced

The pipeline declares critical and high failures, but the IaC stage only warns and leaves its failure command commented.

The declared failure policy directly conflicts with the warning-only IaC result handling.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

assets/ci-config-template.yml:164

Git platform tokens

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow passes GITHUB_TOKEN to a mutable third-party action reference. Compromise could abuse the token's granted repository permissions.

High

SKILL.md:256

sudo privilege escalation

sudo chmod 666 /var/run/docker.sock

This command makes the Docker socket world-writable. Any local process could gain Docker control and effective root-level host access.

High

SKILL.md:257

sudo privilege escalation

# Or run with sudo (not recommended for CI/CD)

The troubleshooting guidance suggests running Horusec with sudo, expanding scanner and dependency compromise impact to root-level host access.

Low

assets/ci-config-template.yml:240

Hardcoded URL

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

This URL supplies a remote script that is executed immediately without integrity verification. Source compromise could run arbitrary CI code.

Low

SKILL.md:298

Hardcoded URL

curl -fsSL https://raw.githubusercontent.com/ZupIT/horusec/main/deployments/scripts/install.sh | bas

This URL supplies a remote installer that is executed immediately without integrity verification. Source compromise could run arbitrary local code.

Risk Factors

⚙️ External commands (50)

🌐 Network access (22)

📁 Filesystem access (2)

assets/ci-config-template.yml:323 assets/ci-config-template.yml:323

🔑 Env variables (23)

⚡ Contains scripts (2)

references/EXAMPLE.md:138 references/EXAMPLE.md:137

Detected Patterns

Pipe to shell pattern×2Docker socket access×3

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentsecops-sast-horusec/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-sast-horusec/security.svg)](https://skillstore.io/skills/agentsecops-sast-horusec?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-sast-horusec?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-sast-horusec/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-sast-horusec.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). sast-horusec security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-sast-horusec/audits/9

BibTeX citation

@techreport{agentsecops-agentsecops-sast-horusec-2026,
  author = {AgentSecOps},
  title = {sast-horusec security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/agentsecops-sast-horusec/audits/9},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sast-horusec security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
  - name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-sast-horusec/audits/9"
identifiers:
  - type: other
    value: "skillstore:agentsecops-sast-horusec:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

100

Spec Compliance

What You Can Build

Review code before commit

Run a local Horusec scan, prioritize severe findings, and confirm fixes before code review.

Add security gates to CI

Configure structured scan output, artifact retention, and enforceable severity thresholds for pull requests.

Investigate exposed secrets

Scan repository history, identify affected credentials, plan rotation, and document remediation decisions.

Try These Prompts

Prepare a repository scan

Review this repository for Horusec. Identify prerequisites, request approval before execution, then summarize findings by severity and file.

Triage an existing report

Analyze this Horusec report. Group findings by severity, identify likely false positives, and propose verified remediation priorities.

Design a CI security gate

Create a Horusec CI plan for this repository. Pin dependencies, protect reports, and enforce critical and high severity thresholds.

Tune a monorepo security program

Design Horusec coverage for this monorepo. Define project scopes, custom rules, exclusions, timeout controls, ownership, and measurable remediation gates.

Best Practices

Pin actions, scanner versions, and container images to immutable revisions.
Run scanners in isolated environments with minimal filesystem, network, and token permissions.
Protect reports as sensitive artifacts and verify every suppression through documented review.