download_then_run_shell (7) and eval_in_shell (6). Includes two workflow-hygiene false positives where the rule matches the scanner's own patterns/comments (security-gate-pr-target.yml, tag-ruleset-canon.yml have no real download-then-run). The satellite eval instances are vendored demo scripts.
Acknowledged in .hypatia-baseline.json (hypatia triage 2026-09-22, expires 2026-12-22) by the main-red fix-forward. This issue is the tracking item; closing it requires either remediating the instances or renewing the acknowledgement.
Instances (13):
content_patterns/download_then_run_shell medium — .github/workflows/security-gate-pr-target.yml
download-then-run banned -- verify checksum/signature before executioncontent_patterns/download_then_run_shell medium — .github/workflows/tag-ruleset-canon.yml
download-then-run banned -- verify checksum/signature before executioncontent_patterns/eval_in_shell medium — rhodium-standard-repositories/rsr-audit.sh
eval banned in shell scripts -- use direct expansion or arrayscontent_patterns/download_then_run_shell medium — rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh
download-then-run banned -- verify checksum/signature before executioncontent_patterns/download_then_run_shell medium — rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh
download-then-run banned -- verify checksum/signature before executioncontent_patterns/eval_in_shell medium — rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh
eval banned in shell scripts -- use direct expansion or arrayscontent_patterns/eval_in_shell medium — rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh
eval banned in shell scripts -- use direct expansion or arrayscontent_patterns/eval_in_shell medium — scripts/tests/fill-placeholders-test.sh
eval banned in shell scripts -- use direct expansion or arrayscontent_patterns/eval_in_shell medium — scripts/tests/propagate-workflow-pins-test.sh
eval banned in shell scripts -- use direct expansion or arrayscontent_patterns/eval_in_shell medium — scripts/tests/propagate-workflow-pins-test.sh
eval banned in shell scripts -- use direct expansion or arrayscontent_patterns/download_then_run_shell medium — setup.sh
download-then-run banned -- verify checksum/signature before executioncontent_patterns/download_then_run_shell medium — setup.sh
download-then-run banned -- verify checksum/signature before executioncontent_patterns/download_then_run_shell medium — tests/test_tag_ruleset_canon.sh
download-then-run banned -- verify checksum/signature before execution
download_then_run_shell(7) andeval_in_shell(6). Includes two workflow-hygiene false positives where the rule matches the scanner's own patterns/comments (security-gate-pr-target.yml, tag-ruleset-canon.yml have no real download-then-run). The satelliteevalinstances are vendored demo scripts.Acknowledged in
.hypatia-baseline.json(hypatia triage 2026-09-22, expires 2026-12-22) by the main-red fix-forward. This issue is the tracking item; closing it requires either remediating the instances or renewing the acknowledgement.Instances (13):
content_patterns/download_then_run_shellmedium —.github/workflows/security-gate-pr-target.ymldownload-then-run banned -- verify checksum/signature before execution
content_patterns/download_then_run_shellmedium —.github/workflows/tag-ruleset-canon.ymldownload-then-run banned -- verify checksum/signature before execution
content_patterns/eval_in_shellmedium —rhodium-standard-repositories/rsr-audit.sheval banned in shell scripts -- use direct expansion or arrays
content_patterns/download_then_run_shellmedium —rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.shdownload-then-run banned -- verify checksum/signature before execution
content_patterns/download_then_run_shellmedium —rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.shdownload-then-run banned -- verify checksum/signature before execution
content_patterns/eval_in_shellmedium —rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sheval banned in shell scripts -- use direct expansion or arrays
content_patterns/eval_in_shellmedium —rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sheval banned in shell scripts -- use direct expansion or arrays
content_patterns/eval_in_shellmedium —scripts/tests/fill-placeholders-test.sheval banned in shell scripts -- use direct expansion or arrays
content_patterns/eval_in_shellmedium —scripts/tests/propagate-workflow-pins-test.sheval banned in shell scripts -- use direct expansion or arrays
content_patterns/eval_in_shellmedium —scripts/tests/propagate-workflow-pins-test.sheval banned in shell scripts -- use direct expansion or arrays
content_patterns/download_then_run_shellmedium —setup.shdownload-then-run banned -- verify checksum/signature before execution
content_patterns/download_then_run_shellmedium —setup.shdownload-then-run banned -- verify checksum/signature before execution
content_patterns/download_then_run_shellmedium —tests/test_tag_ruleset_canon.shdownload-then-run banned -- verify checksum/signature before execution