The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to download an installation script from https://get.anchore.io/grype, which is an official domain belonging to Anchore, a recognized security vendor.\n- [REMOTE_CODE_EXECUTION]: The provided installation method uses a shell-piped pattern (curl | sh), which directly executes remote code in the local environment.\n- [PRIVILEGE_ESCALATION]: The installation instructions utilize sudo to install the Grype binary to the /usr/local/bin directory, requiring administrative privileges.\n- [COMMAND_EXECUTION]: The skill relies on the execution of the Grype command-line tool to perform security scans on local directories, container images, and SBOM files.\n- [PROMPT_INJECTION]: The skill processes untrusted external data (SBOMs and container images) without specific boundary markers or sanitization, creating a surface for indirect prompt injection where malicious content in the scanned data could influence agent behavior.\n- [NO_CODE]: The skill does not include any executable scripts or binary files, providing only configuration examples and instructional documentation.

grype-scanning