Skills sca-blackduck
📦
sca-blackduck
v0.1.0 Content revision r2 Critical 📁 Filesystem access⚙️ External commands🌐 Network access🔑 Env variables⚡ Contains scripts
Assess Dependencies with Black Duck
Dependency vulnerabilities and license risks can reach production unnoticed. This skill guides Black Duck scans, policy gates, SBOM creation, and remediation triage.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "sca-blackduck" from https://skillstore.io/skills/agentsecops-sca-blackduck.md and its manifest at https://skillstore.io/api/skills/agentsecops-sca-blackduck/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "sca-blackduck". Triage one critical library vulnerability with a fixed version.
Expected outcome:
- Priority: Immediate because the vulnerable component is deployed and a supported fixed version exists.
- Action: Upgrade in a test branch, run compatibility tests, and repeat the Black Duck scan.
- Evidence: Record the original finding, fixed version, validation result, owner, and completion date.
Using "sca-blackduck". Review a new copyleft license finding.
Expected outcome:
- Classify the license obligations and confirm whether distribution triggers them.
- Ask legal counsel to review product use, linking method, and planned distribution.
- Replace the component or document a time-limited approved exception.
Using "sca-blackduck". Define a pull request dependency gate.
Expected outcome:
Run on relevant dependency changes, block approved severity violations, retain reports, and fail when scan status is unavailable.
Security Audit
Criticalv9 • 7/23/2026 Open versioned report
Most static alerts are false positives caused by Markdown examples, reference URLs, configuration exclusions, and legitimate environment access. Confirmed findings involve unverified remote scripts executed by CI templates and user instructions. Additional review found mutable GitHub Action tags, unsafe Jenkins interpolation, and a pull request comment that reports fixed zero findings.
15
Files scanned
4,881
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (5)
Critical
Pipe to shell pattern
curl -s -L https://detect.synopsys.com/detect.sh | bash -- \
The CI template pipes a mutable network response directly into Bash without a pinned version or integrity check. A compromised upstream response would execute with runner privileges.
Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template pipes a mutable network response directly into Bash without a pinned version or integrity check. A compromised upstream response would execute with runner privileges.
High
Misleading fixed security results
The GitHub workflow posts zero vulnerability counts and no license violations without parsing results, which can mislead reviewers.
The comment body contains fixed zero counts and an unconditional no-violations statement. Nearby comments acknowledge that actual results are not parsed.
High
assets/ci_integration/jenkins_pipeline.groovy:32-34assets/ci_integration/jenkins_pipeline.groovy:89-99assets/ci_integration/jenkins_pipeline.groovy:142-151
Jenkins shell injection and secret exposure
Groovy interpolates branch-derived values and Black Duck credentials into shell strings before execution, enabling command injection and exposing secrets in process arguments.
The double-quoted Groovy strings interpolate BRANCH_NAME-derived project data and BLACKDUCK_TOKEN into commands later passed to sh. No argument-safe execution boundary is used.
Medium
assets/ci_integration/github_actions.yml:31assets/ci_integration/github_actions.yml:39assets/ci_integration/github_actions.yml:57assets/ci_integration/github_actions.yml:81assets/ci_integration/github_actions.yml:101assets/ci_integration/github_actions.yml:143assets/ci_integration/github_actions.yml:148
Mutable GitHub Action references
GitHub Actions use mutable major-version tags, allowing upstream changes to execute with repository and token permissions.
Each uses statement ends in a mutable tag such as v1, v3, v4, or v7 rather than an immutable commit SHA.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
curl -s -L https://detect.synopsys.com/detect.sh | bash -- \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
High
Hardcoded URL
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.
Risk Factors
📁 Filesystem access (6)
⚙️ External commands (50)
assets/ci_integration/github_actions.yml:110 assets/ci_integration/github_actions.yml:111 assets/ci_integration/github_actions.yml:92 assets/ci_integration/gitlab_ci.yml:121 assets/ci_integration/gitlab_ci.yml:151 assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 references/supply_chain_threats.md:199 references/supply_chain_threats.md:204 references/supply_chain_threats.md:205 references/supply_chain_threats.md:200 references/supply_chain_threats.md:532 references/supply_chain_threats.md:205 references/supply_chain_threats.md:286 references/supply_chain_threats.md:335 references/supply_chain_threats.md:513 SKILL.md:40-47 SKILL.md:47-51 SKILL.md:51-57 SKILL.md:57-65 SKILL.md:65-79 SKILL.md:79-97 SKILL.md:97-151 SKILL.md:151-152 SKILL.md:152-153 SKILL.md:153-154 SKILL.md:154-158 SKILL.md:158-159 SKILL.md:159-160 SKILL.md:160-161 SKILL.md:161-165 SKILL.md:165-166 SKILL.md:166-167 SKILL.md:167-168 SKILL.md:168-169 SKILL.md:169-175 SKILL.md:175-183 SKILL.md:183-187 SKILL.md:187-194 SKILL.md:194-198 SKILL.md:198-205 SKILL.md:205-209 SKILL.md:209-216 SKILL.md:216-220
🌐 Network access (50)
assets/ci_integration/github_actions.yml:70 assets/ci_integration/gitlab_ci.yml:30 assets/ci_integration/gitlab_ci.yml:85 assets/ci_integration/gitlab_ci.yml:181 assets/ci_integration/jenkins_pipeline.groovy:90 assets/ci_integration/jenkins_pipeline.groovy:143 assets/ci-config-template.yml:240 assets/policy_templates/security_policy.json:2 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 references/license_risk_guide.md:361 references/remediation_strategies.md:209 references/remediation_strategies.md:301 references/remediation_strategies.md:302 references/supply_chain_threats.md:193 references/supply_chain_threats.md:62 references/supply_chain_threats.md:65 references/supply_chain_threats.md:66 references/supply_chain_threats.md:69 references/supply_chain_threats.md:75 references/supply_chain_threats.md:193 references/supply_chain_threats.md:200 references/supply_chain_threats.md:388 references/supply_chain_threats.md:412 references/supply_chain_threats.md:413 references/supply_chain_threats.md:518 SKILL.md:21 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:42 SKILL.md:53 SKILL.md:189 SKILL.md:280 SKILL.md:293 SKILL.md:299 SKILL.md:385 SKILL.md:386
🔑 Env variables (37)
assets/ci_integration/github_actions.yml:110 assets/ci_integration/github_actions.yml:111 assets/ci_integration/github_actions.yml:110 assets/ci_integration/github_actions.yml:111 assets/ci_integration/github_actions.yml:41 assets/ci_integration/github_actions.yml:103 assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444 references/supply_chain_threats.md:189 references/supply_chain_threats.md:190 references/supply_chain_threats.md:191 references/supply_chain_threats.md:189 references/supply_chain_threats.md:190 references/supply_chain_threats.md:191 references/supply_chain_threats.md:190 references/supply_chain_threats.md:191
Detected Patterns
Pipe to shell pattern×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/agentsecops-sca-blackduck/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/agentsecops-sca-blackduck?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/agentsecops-sca-blackduck?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-sca-blackduck/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/agentsecops-sca-blackduck.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
AgentSecOps. (2026). sca-blackduck security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-sca-blackduck/audits/9BibTeX citation
@techreport{agentsecops-agentsecops-sca-blackduck-2026,
author = {AgentSecOps},
title = {sca-blackduck security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/agentsecops-sca-blackduck/audits/9},
note = {Author version 0.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sca-blackduck security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-sca-blackduck/audits/9"
identifiers:
- type: other
value: "skillstore:agentsecops-sca-blackduck:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 59
Architecture
100
Maintainability
87
Content
71
Community
91
Spec Compliance
What You Can Build
Triage dependency vulnerabilities
Prioritize Black Duck findings, map affected components, and recommend upgrades or compensating controls.
Build a CI policy gate
Adapt a pipeline template to scan dependencies, retain reports, and enforce approved severity thresholds.
Review license exposure
Classify dependency licenses, identify policy conflicts, and prepare exceptions for legal review.
Try These Prompts
Plan a first scan
Identify dependency manifests in [repository]. Propose a Black Duck scan plan with required credentials and expected reports.
Triage scan findings
Review these Black Duck findings: [findings]. Prioritize remediation by exploitability, component reachability, fixed versions, and business impact.
Design a policy gate
Design a [CI platform] Black Duck gate for [repository]. Define scan triggers, policy thresholds, artifact retention, and failure behavior.
Assess supply chain exposure
Assess [dependency portfolio] for dependency confusion, abandoned components, compromised maintainers, license conflicts, and SBOM gaps. Produce a prioritized control plan.
Best Practices
- Store Black Duck tokens in the CI secret store and grant only required permissions.
- Pin and verify every downloaded installer and third-party CI action.
- Repeat scans after dependency changes and record evidence for accepted risks.
Avoid
- Do not execute downloaded scripts without version pinning and integrity verification.
- Do not treat placeholder summaries as evidence of a successful clean scan.
- Do not rely on referenced scripts that are absent from the installed package.
Frequently Asked Questions
Does this skill run Black Duck scans automatically?
No. It provides instructions and CI templates. You need Black Duck access, credentials, and a supported execution environment.
Which CI systems are covered?
The package includes templates for GitHub Actions, GitLab CI, and Jenkins.
Can it generate an SBOM?
It explains Black Duck SBOM workflows for CycloneDX and SPDX. Referenced helper scripts are not included.
Does it provide current CVE data?
No. Current findings must come from Black Duck or another maintained vulnerability source.
Can it make legal license decisions?
No. It supports risk classification and documentation, but qualified counsel should approve legal conclusions.
Are the bundled CI templates production ready?
No. Pin dependencies, verify installers, correct result parsing, and review secret handling before deployment.
Developer Details
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r2
Ref
181fdefcafd96b041926e61c4b2e306ca7e7820e
Maintenance freshness
7/24/2026
Usage
6 downloads · 261 views