scanning-containers-with-trivy-in-cicd

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The CI workflows reference and will fetch/execute external runtime code — e.g., the GitHub Action "aquasecurity/trivy-action@0.28.0" (https://github.com/aquasecurity/trivy-action) and the Docker image "aquasec/trivy:latest" (docker.io/aquasec/trivy:latest) — which are downloaded at runtime and run, so the skill depends on remote code execution.