sca-trivy

Name: sca-trivy
Availability: InStock
Author: rohun

Scan container images, dependencies, and IaC for CVEs using Trivy.

232|38|Updated Jan 18, 2026

Search Tags:#trivy #sbom #sca #container-security #vulnerability-scanning #iac-security

Ready to run

npx skills add https://github.com/rohunj/claude-build-workflow --skill sca-trivy

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sca-trivy
Source: https://github.com/rohunj/claude-build-workflow/tree/main/skills/security/sca-trivy
Command: npx skills add https://github.com/rohunj/claude-build-workflow --skill sca-trivy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Software supply chain and container security require continuous scanning of images, dependencies, and IaC to identify CVEs, misconfigurations, and license risks, which this skill automates using Trivy.

Core Features & Use Cases

SCA and container vulnerability scanning for CVEs and misconfigurations across languages and ecosystems.
SBOM generation in CycloneDX or SPDX formats and CI/CD integration with SARIF outputs.
Prioritized remediation guidance based on CVSS and exploitability across Terraform, Kubernetes, Dockerfiles, and container images.

Quick Start

Run a Trivy-based security scan of your container image, dependencies, and IaC to generate a prioritized remediation report.

Frequently Asked Questions about sca-trivy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan container images for vulnerabilities and misconfigurations in a CI/CD pipeline?▼

To scan container images for vulnerabilities and misconfigurations in a CI/CD pipeline, perform Software Composition Analysis using Trivy to identify CVEs and generate SARIF outputs for integrated remediation tracking.

What is the best way to generate an SBOM for dependencies across multiple languages?▼

Generating an SBOM for dependencies across multiple languages involves analyzing your project ecosystem to produce CycloneDX or SPDX formats, detailing all software components and associated vulnerability risks.

Does Trivy support Infrastructure as Code security scanning for Terraform and Kubernetes?▼

Yes, Trivy supports Infrastructure as Code security scanning for Terraform, Kubernetes, and Dockerfiles, identifying misconfigurations and providing policy-based remediation prioritization for your deployments.

How do I prioritize vulnerability remediation using CVSS scores?▼

You prioritize vulnerability remediation using CVSS scores by evaluating exploitability and severity metrics provided by the SCA scan, allowing you to target the most critical CVEs across your containers and dependencies.

Can I output container vulnerability scanning results in SARIF format?▼

Yes, you can output container vulnerability scanning results in SARIF format, enabling seamless integration with CI/CD pipelines and code scanning tools to visualize and track security issues.