sca-grype

Fail

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the Grype installation script from the official Anchore GitHub repository.- [REMOTE_CODE_EXECUTION]: The skill executes the installation script by piping the output of curl directly to the shell (sh). This is the standard, vendor-recommended installation procedure.- [COMMAND_EXECUTION]: The skill runs the grype command line utility to scan directories and images.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the local filesystem or container images, which could contain malicious data designed to influence the agent's behavior.
  • Ingestion points: Filesystem directories, container images, and SBOM files (SKILL.md).
  • Boundary markers: None present to distinguish between instructions and data in the scanned files.
  • Capability inventory: Executes the grype tool which parses complex file formats.
  • Sanitization: No validation or sanitization is performed on external inputs before processing.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/anchore/grype/main/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 27, 2026, 06:47 PM
Security Audit — agent-trust-hub — sca-grype