Skills
Navigate
skills/naporin0624/claude-web-audit-plugins/container-scanner/Gen Agent Trust Hub

container-scanner

Pass

Audited by Gen Agent Trust Hub on Jun 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The SKILL.md file provides installation instructions for the Trivy scanner that involve downloading a shell script directly from the official Aqua Security GitHub repository (https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh).
  • [COMMAND_EXECUTION]: The application uses child_process.spawn and child_process.spawnSync to execute the hadolint and trivy binaries on the local system. This is the primary functionality of the skill, and the use of spawn with an arguments array (rather than exec) is a best practice that prevents shell injection attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 29, 2026, 02:32 AM
Security Audit — agent-trust-hub — container-scanner