supply-chain-audit
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to download and execute installation scripts for the syft and grype security tools directly from Anchore's official GitHub repositories using a pipe-to-shell pattern (curl | sh). This is a standard and expected installation method for these industry-standard developer tools.
- [EXTERNAL_DOWNLOADS]: Fetches security auditing tools and language-specific scanners from official registries and repositories, including the official Go toolchain, Snyk (via NPM), and pip-audit (via PyPI).
- [COMMAND_EXECUTION]: Orchestrates a series of local security assessments by executing multiple external tools such as trivy, gitleaks, trufflehog, and govulncheck to analyze source code, lockfiles, and container images to identify potential vulnerabilities.
Audit Metadata