sca-grype
Fail
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Grype installation script from the official Anchore GitHub repository.- [REMOTE_CODE_EXECUTION]: The skill executes the installation script by piping the output of curl directly to the shell (sh). This is the standard, vendor-recommended installation procedure.- [COMMAND_EXECUTION]: The skill runs the grype command line utility to scan directories and images.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the local filesystem or container images, which could contain malicious data designed to influence the agent's behavior.
- Ingestion points: Filesystem directories, container images, and SBOM files (SKILL.md).
- Boundary markers: None present to distinguish between instructions and data in the scanned files.
- Capability inventory: Executes the grype tool which parses complex file formats.
- Sanitization: No validation or sanitization is performed on external inputs before processing.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/anchore/grype/main/install.sh - DO NOT USE without thorough review
Audit Metadata