skills.rest
rohunj
rohunjCOMMUNITY
Explore all skills by this author →
Website𝕏@rohunjauharGitHub

sca-trivy

Scan container images, dependencies, and IaC for CVEs using Trivy.

232|38|Updated Jan 18, 2026
Search Tags:#trivy#sbom#sca#container-security#vulnerability-scanning#iac-security
One-click install
npx skills add https://github.com/rohunj/claude-build-workflow --skill sca-trivy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sca-trivy
Source: https://github.com/rohunj/claude-build-workflow/tree/main/skills/security/sca-trivy
Command: npx skills add https://github.com/rohunj/claude-build-workflow --skill sca-trivy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Software supply chain and container security require continuous scanning of images, dependencies, and IaC to identify CVEs, misconfigurations, and license risks, which this skill automates using Trivy.

Core Features & Use Cases

  • SCA and container vulnerability scanning for CVEs and misconfigurations across languages and ecosystems.
  • SBOM generation in CycloneDX or SPDX formats and CI/CD integration with SARIF outputs.
  • Prioritized remediation guidance based on CVSS and exploitability across Terraform, Kubernetes, Dockerfiles, and container images.

Quick Start

Run a Trivy-based security scan of your container image, dependencies, and IaC to generate a prioritized remediation report.

Frequently Asked Questions about sca-trivy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan container images for vulnerabilities and misconfigurations in a CI/CD pipeline?▼

To scan container images for vulnerabilities and misconfigurations in a CI/CD pipeline, perform Software Composition Analysis using Trivy to identify CVEs and generate SARIF outputs for integrated remediation tracking.

What is the best way to generate an SBOM for dependencies across multiple languages?▼

Generating an SBOM for dependencies across multiple languages involves analyzing your project ecosystem to produce CycloneDX or SPDX formats, detailing all software components and associated vulnerability risks.

Does Trivy support Infrastructure as Code security scanning for Terraform and Kubernetes?▼

Yes, Trivy supports Infrastructure as Code security scanning for Terraform, Kubernetes, and Dockerfiles, identifying misconfigurations and providing policy-based remediation prioritization for your deployments.

How do I prioritize vulnerability remediation using CVSS scores?▼

You prioritize vulnerability remediation using CVSS scores by evaluating exploitability and severity metrics provided by the SCA scan, allowing you to target the most critical CVEs across your containers and dependencies.

Can I output container vulnerability scanning results in SARIF format?▼

Yes, you can output container vulnerability scanning results in SARIF format, enabling seamless integration with CI/CD pipelines and code scanning tools to visualize and track security issues.

Related Skills

Explore More Software Engineering Skills→
HouseGarofaloHouseGarofalo
3

security-scanner

Scan container images, dependencies, and IaC for security vulnerabilities.

Official
Advanced
Cogni-AI-OUCogni-AI-OU
3

sbom

Generate SPDX and CycloneDX JSON SBOM inventories using syft CLI.

Official
Basic
randalmurphalrandalmurphal

Vulnerability Triage & Prioritization

Compute CVSS scores and prioritize vulnerabilities with weighted ranking.

Community
Basic
hung-phanhung-phan

vulnerability-management

Prioritize CVEs using CVSS, EPSS, KEV, and reachability analysis.

Community
Advanced