skills.rest
broadinstitute
broadinstituteOFFICIAL
Explore all skills by this author →
Website𝕏@broadinstituteGitHub

Container Vulnerability Management

Scan viral-ngs Docker images with Trivy and triage HIGH/CRITICAL CVEs.

198|67|Updated Sep 25, 2014
Search Tags:#container security#vulnerability scanning#trivy#docker images#github security#cve triage#rego policy
One-click install
npx skills add https://github.com/broadinstitute/viral-ngs --skill container-vulnerability-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Container Vulnerability Management
Source: https://github.com/broadinstitute/viral-ngs/tree/main/.agents/skills/container-vulns
Command: npx skills add https://github.com/broadinstitute/viral-ngs --skill container-vulnerability-management

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you systematically identify and reduce security vulnerabilities in the viral-ngs container image stack by scanning, filtering, triaging, and documenting remediation decisions.

Core Features & Use Cases

  • Automated vulnerability scanning: Uses Trivy to scan multiple Docker image flavors and produces results for GitHub Security (SARIF) and artifact retention (JSON).
  • Policy-driven risk filtering: Applies a Rego policy to filter architecturally inapplicable findings and supports per-CVE overrides with mandatory justification.
  • Operational triage workflow: On a weekly schedule, detects new fixable HIGH/CRITICAL issues and automatically creates CVE-labeled GitHub issues after AI-assisted triage.
  • Mitigation guidance for bioinformatics containers: Provides practical checks for common vulnerability sources like Python transitive dependencies, vendored libraries in uber JARs, and embedded Go binaries.

Quick Start

Ask the AI to produce a CVE triage decision for a specific Trivy finding from your weekly container scan and reference whether it should be filtered by the Rego policy or handled via a .trivyignore exception with justification.

Frequently Asked Questions about Container Vulnerability Management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Docker image vulnerability scanning and triage for HIGH and CRITICAL CVEs?▼

Automate container vulnerability scanning by running Trivy across Docker image flavors on a weekly schedule, then triaging fixable HIGH and CRITICAL CVEs to automatically create labeled GitHub issues for tracking.

What is the best way to filter out architecturally inapplicable Trivy findings from Docker security scans?▼

Filter inapplicable Trivy findings by applying a Rego policy to your container vulnerability scanning workflow, which removes noise while allowing per-CVE overrides with mandatory justification through a .trivyignore file.

How do I document risk assessments and exceptions for ignored vulnerabilities in GitHub Security?▼

Document risk assessments by enforcing mandatory per-CVE justification within the .trivyignore file, ensuring all exception decisions for your Docker images are recorded for GitHub Security tracking and audit purposes.

Can I use Trivy SARIF output to track container vulnerabilities in GitHub issues?▼

Yes, Trivy scans Docker images and produces SARIF results for GitHub Security alongside JSON artifact retention, enabling AI-assisted triage that targets unfixed CVE IDs and automatically files labeled GitHub issues.

How do I identify vulnerability sources like Python transitive dependencies and vendored libraries in bioinformatics containers?▼

Identify vulnerability sources in bioinformatics containers by running practical checks for Python transitive dependencies, vendored libraries in uber JARs, and embedded Go binaries during your Trivy vulnerability triage workflow.

Why does my Trivy scan report CVEs that cannot be fixed in my Docker image hierarchy?▼

Trivy scans report unfixed CVE IDs across your Docker image hierarchy because certain vulnerabilities have no available patches, requiring AI-assisted triage and documented risk assessments via Rego policy filtering or .trivyignore exceptions.

Related Skills

Explore More Software Engineering Skills→
jayjpatel9717jayjpatel9717

container-security

Scan Docker images and audit Kubernetes clusters for security vulnerabilities.

Community
Advanced
matteocervellimatteocervelli
25

vulnerability-assessor

Assess software vulnerabilities with CVSS scoring and remediation planning.

Community
Advanced
weirdgmeweirdgme
4

devsecops

Automate security integration across CI/CD pipelines with policy-as-code enforcement.

Community
Advanced
statick88statick88
1

vulnerability-scanning

Automate vulnerability detection across code, dependencies, containers, and infrastructure.

Community
Advanced