securing-container-registry-images

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes install commands that fetch-and-execute remote scripts (curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh and curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh) and a go install of github.com/sigstore/cosign/v2/... which downloads and builds remote code, so it requires executing externally fetched code at setup/runtime.