Versioned security assessment

Report ID: SA-181FDEFC

7/23/2026, 6:53:53 AM

sca-blackduck security assessment v9

Skill Security Certification Report

Scanner version 3.0.0 Audit model: codex Latest published report

Skill name: sca-blackduck
Version: v0.1.0
Maintainer: AgentSecOps
Source: github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/sca-blackduck
Coverage: 15 Files scanned · 4,881 Lines analyzed
Policy version: skillstore-security-audit-policy-v1

Highest confirmed finding severity

Critical

5 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are false positives caused by Markdown examples, reference URLs, configuration exclusions, and legitimate environment access. Confirmed findings involve unverified remote scripts executed by CI templates and user instructions. Additional review found mutable GitHub Action tags, unsafe Jenkins interpolation, and a pull request comment that reports fixed zero findings.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

15 Files scanned · 4,881 Lines analyzed

18 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Commit and path bound
Artifact

Content and tree hashes bound
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 49 evidence locations

Filesystem access

May read or write local files.

Observed in 5 evidence locations

Env variables

May read values from the process environment.

Observed in 25 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 49 evidence locations

Capability review items (13)

High

assets/ci_integration/github_actions.yml:70

Hardcoded URL

curl -s -L https://detect.synopsys.com/detect.sh | bash -- \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

assets/ci_integration/gitlab_ci.yml:30

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

assets/ci_integration/gitlab_ci.yml:85

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

assets/ci_integration/gitlab_ci.yml:181

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

assets/ci_integration/jenkins_pipeline.groovy:90

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

assets/ci_integration/jenkins_pipeline.groovy:143

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

assets/ci-config-template.yml:240

Hardcoded URL

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

High

Hardcoded URL

bash <(curl -s -L https://detect.synopsys.com/detect.sh) \

This URL supplies a script that is executed immediately without version pinning or integrity verification. A compromised response would execute with CI or user privileges.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 Critical

assets/ci_integration/github_actions.yml:70

Pipe to shell pattern

curl -s -L https://detect.synopsys.com/detect.sh | bash -- \

The CI template pipes a mutable network response directly into Bash without a pinned version or integrity check. A compromised upstream response would execute with runner privileges.

RISK-002 Critical

assets/ci-config-template.yml:240

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The CI template pipes a mutable network response directly into Bash without a pinned version or integrity check. A compromised upstream response would execute with runner privileges.

RISK-003 High

assets/ci_integration/github_actions.yml:113-125

Misleading fixed security results

The GitHub workflow posts zero vulnerability counts and no license violations without parsing results, which can mislead reviewers.

The comment body contains fixed zero counts and an unconditional no-violations statement. Nearby comments acknowledge that actual results are not parsed.

RISK-004 High

assets/ci_integration/jenkins_pipeline.groovy:32-34 assets/ci_integration/jenkins_pipeline.groovy:89-99 assets/ci_integration/jenkins_pipeline.groovy:142-151

Jenkins shell injection and secret exposure

Groovy interpolates branch-derived values and Black Duck credentials into shell strings before execution, enabling command injection and exposing secrets in process arguments.

The double-quoted Groovy strings interpolate BRANCH_NAME-derived project data and BLACKDUCK_TOKEN into commands later passed to sh. No argument-safe execution boundary is used.

RISK-005 Medium

assets/ci_integration/github_actions.yml:31 assets/ci_integration/github_actions.yml:39 assets/ci_integration/github_actions.yml:57 assets/ci_integration/github_actions.yml:81 assets/ci_integration/github_actions.yml:101 assets/ci_integration/github_actions.yml:143 assets/ci_integration/github_actions.yml:148

Mutable GitHub Action references

GitHub Actions use mutable major-version tags, allowing upstream changes to execute with repository and token permissions.

Each uses statement ends in a mutable tag such as v1, v3, v4, or v7 rather than an immutable commit SHA.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
Critical
CI templates and instructions execute scripts downloaded from mutable URLs.

Download a versioned release, verify its checksum or signature, and execute only the verified local artifact.
FIX-002
High
The GitHub pull request comment reports fixed zero findings.

Parse generated scan results and fail closed when results are absent, malformed, or incomplete.
FIX-003
High
The Jenkins pipeline interpolates branch data and credentials into shell command strings.

Pass values through environment variables, quote them inside the shell, and use Jenkins credential bindings without Groovy interpolation.
FIX-004
Medium
GitHub Actions use mutable major-version tags.

Pin every action to a reviewed full commit SHA and use an automated process for controlled updates.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: 181fdefcafd96b041926e61c4b2e306ca7e7820e
Content hash: 423c6c504e7d1c7d813281bb58789e3d49dd1fec85872296c662788dbe6e3eff
Tree hash: d6648b9cea79c8f6fc9ee23a78245125d79136ac68bdd03a3e9e949678dab163
Skill path: skills/agentsecops/sca-blackduck
Audit payload hash: ec2469ba3eaf655f4b0b8834582136d8

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active