Audit History

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The template downloads a mutable remote script and executes it without integrity verification. A compromised source can run arbitrary CI code.

Critical

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/ZupIT/horusec/main/deployments/scripts/install.sh | bas

The installation command pipes an unverified remote script directly into Bash. A compromised branch or account could execute arbitrary code.

Critical

SKILL.md:39

Docker socket access

docker run -v /var/run/docker.sock:/var/run/docker.sock \

The command gives a mutable Horusec container direct Docker socket access. Container compromise can control sibling containers and the host.

Critical

SKILL.md:213

Docker socket access

docker run -v /var/run/docker.sock:/var/run/docker.sock \

The CI example gives a mutable Horusec container direct Docker socket access. Image compromise can control the runner host.

Critical

SKILL.md:39-40 SKILL.md:213-214

Docker socket access

sudo chmod 666 /var/run/docker.sock

World-writable Docker socket permissions let any local process control Docker. This commonly provides effective root-level host access.

Critical

Mutable privileged container dependency

The guide runs mutable Horusec images with the host Docker socket, allowing a compromised image to control the host.

Both examples combine a latest image tag with direct host Docker socket access.

High

assets/ci-config-template.yml:34 assets/ci-config-template.yml:246-256

Declared CI thresholds are not enforced

The pipeline declares critical and high failures, but the IaC stage only warns and leaves its failure command commented.

The declared failure policy directly conflicts with the warning-only IaC result handling.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

assets/ci-config-template.yml:164

Git platform tokens

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow passes GITHUB_TOKEN to a mutable third-party action reference. Compromise could abuse the token's granted repository permissions.

High

sudo privilege escalation

sudo chmod 666 /var/run/docker.sock

This command makes the Docker socket world-writable. Any local process could gain Docker control and effective root-level host access.

High

SKILL.md:257

sudo privilege escalation

# Or run with sudo (not recommended for CI/CD)

The troubleshooting guidance suggests running Horusec with sudo, expanding scanner and dependency compromise impact to root-level host access.

Low

Hardcoded URL

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

This URL supplies a remote script that is executed immediately without integrity verification. Source compromise could run arbitrary CI code.

Low

assets/ci-config-template.yml:323 assets/ci-config-template.yml:323

Hardcoded URL

curl -fsSL https://raw.githubusercontent.com/ZupIT/horusec/main/deployments/scripts/install.sh | bas

This URL supplies a remote installer that is executed immediately without integrity verification. Source compromise could run arbitrary local code.

Risk Factors

⚙️ External commands (50)

🌐 Network access (22)

📁 Filesystem access (2)

🔑 Env variables (23)

⚡ Contains scripts (2)

references/EXAMPLE.md:138 references/EXAMPLE.md:137

Detected Patterns

Pipe to shell patternPipe to shell patternDocker socket accessDocker socket accessDocker socket access

Audited by: codex

Audit version 8

Jul 7, 2026, 09:44 PM

Most static findings are false positives from Markdown examples, rule templates, and defensive security references. The confirmed risks are unsafe installation and Docker guidance: remote scripts piped to shell, Docker socket exposure, and broad Docker socket permission changes.

6

Files scanned

1,886

Lines analyzed

14

Review items

0

False positives ignored

Confirmed security concerns (5)

Critical

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The CI template pipes a remote installer script directly into bash without integrity verification. A compromised upstream script or download path could execute arbitrary commands in the runner.

Critical

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/ZupIT/horusec/main/deployments/scripts/install.sh | bas

The skill recommends piping a remote install script directly to bash. That pattern executes unaudited remote code in the user shell and creates a supply-chain execution risk.

Critical

SKILL.md:39

Docker socket access

docker run -v /var/run/docker.sock:/var/run/docker.sock \

The Docker command mounts the host Docker socket into the Horusec container. Container access to the Docker daemon can provide effective host control on many systems.

Critical

SKILL.md:213

Docker socket access

docker run -v /var/run/docker.sock:/var/run/docker.sock \

The GitHub Actions example mounts the host Docker socket into the scanning container. A compromised container image or analyzer could control the runner Docker daemon.

Critical

Docker socket access

sudo chmod 666 /var/run/docker.sock

The troubleshooting guidance changes permissions on the Docker socket. Making this socket broadly accessible can allow local privilege escalation through Docker daemon control.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

Hardcoded URL

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The URL is used in a CI command that downloads an installer script and immediately executes it. This network dependency is part of an unsafe remote code execution path.

High

sudo privilege escalation

sudo chmod 666 /var/run/docker.sock

The guidance suggests using sudo to change Docker socket permissions to a world-writable mode. This weakens host isolation and can expose privileged Docker control to untrusted local processes.

High

SKILL.md:257

sudo privilege escalation

# Or run with sudo (not recommended for CI/CD)

The text suggests elevated execution as a workaround, even though it notes this is not recommended for CI/CD. Running scanning tooling with sudo increases impact if the tool chain is compromised.

High

assets/ci-config-template.yml:323 assets/ci-config-template.yml:323

Hardcoded URL

curl -fsSL https://raw.githubusercontent.com/ZupIT/horusec/main/deployments/scripts/install.sh | bas

The URL appears inside an install command that pipes remote content into bash. This is more than a reference link because it is part of a command users may execute.

Risk Factors

⚙️ External commands (67)

🌐 Network access (22)

📁 Filesystem access (2)

🔑 Env variables (23)

⚡ Contains scripts (2)

references/EXAMPLE.md:138 references/EXAMPLE.md:137

Detected Patterns

Pipe to shell patternPipe to shell patternDocker socket accessDocker socket accessDocker socket access

Audited by: codex

Audit version 7

Jul 6, 2026, 01:23 AM

Most static alerts are false positives from examples, reference links, or Markdown formatting. Confirmed risks include Docker socket exposure, world-writable Docker socket guidance, and remote installer scripts piped to shell. Additional supply-chain hardening is needed for mutable CI actions, scanner images, and unpinned tool installs.

5

Files scanned

1,876

Lines analyzed

14

Review items

2

False positives ignored

Confirmed security concerns (7)

Critical

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The guidance pipes a remote installer directly into bash. This creates remote code execution and supply-chain risk without pinning or checksum verification.

Critical

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/ZupIT/horusec/main/deployments/scripts/install.sh | bas

The guidance pipes a remote installer directly into bash. This creates remote code execution and supply-chain risk without pinning or checksum verification.

Critical

SKILL.md:39

Docker socket access

docker run -v /var/run/docker.sock:/var/run/docker.sock \

The skill guidance exposes /var/run/docker.sock to scanner containers or changes its permissions. Docker socket access can provide host-level control, especially on CI runners.

Critical

SKILL.md:213

Docker socket access

docker run -v /var/run/docker.sock:/var/run/docker.sock \

The skill guidance exposes /var/run/docker.sock to scanner containers or changes its permissions. Docker socket access can provide host-level control, especially on CI runners.

Critical

assets/ci-config-template.yml:197 SKILL.md:39-40 SKILL.md:222

Docker socket access

sudo chmod 666 /var/run/docker.sock

The skill guidance exposes /var/run/docker.sock to scanner containers or changes its permissions. Docker socket access can provide host-level control, especially on CI runners.

High

Unpinned CI Actions and Scanner Images

The CI and usage guidance references mutable action refs and latest scanner images. A mutable security tool chain can change without review and expose users to compromised or inconsistent scans.

The cited lines use mutable refs and latest tags in CI or scanner execution guidance. This is a clear supply-chain hardening gap for a security scanning workflow.

Medium

assets/ci-config-template.yml:57 assets/ci-config-template.yml:119 assets/ci-config-template.yml:230

Unpinned Security Tool Installation in CI Template

The CI template installs security tools without fixed versions. Build behavior can drift or be compromised through package supply-chain changes.

The template calls package installers without explicit versions. This is common in examples, but security CI templates should be reproducible and pinned.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical