skills.rest
mirandagabrieldev
mirandagabrieldevCOMMUNITY
Explore all skills by this author →
GitHub

sca-trivy

Scan containers, dependencies, and IaC for vulnerabilities with Trivy.

Updated Aug 23, 2026
Search Tags:#trivy#sbom#sca#container-security#vulnerability-scanning#dependency-scanning#iac-security
One-click install
npx skills add https://github.com/mirandagabrieldev/claude-build-template --skill sca-trivy-mirandagabrieldev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sca-trivy
Source: https://github.com/mirandagabrieldev/claude-build-template/tree/main/skills/security/sca-trivy
Command: npx skills add https://github.com/mirandagabrieldev/claude-build-template --skill sca-trivy-mirandagabrieldev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Trivy-based SCA and vulnerability scanning for containers, IaC, and dependencies to help teams identify CVEs, misconfigurations, license risks, and prioritize remediation.

Core Features & Use Cases

  • Container image vulnerability assessment
  • Dependency vulnerability scanning
  • IaC security checks
  • SBOM generation
  • CI/CD integration with SARIF
  • Remediation prioritization by CVSS

Quick Start

Run a Trivy scan on a container image or filesystem and generate a SARIF report to begin vulnerability assessment.

Frequently Asked Questions about sca-trivy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan container images for vulnerabilities and generate a SARIF report?▼

Scanning container images for vulnerabilities involves running a Trivy scan against the image and outputting the results as a SARIF report. This process identifies CVEs and provides remediation guidance for CI/CD integration.

What is SBOM generation and when do I need CycloneDX or SPDX formats?▼

SBOM generation creates a formal inventory of software components and dependencies. You need CycloneDX or SPDX formats when standardizing dependency tracking for compliance or when integrating vulnerability scanning into automated security workflows.

Can I use Trivy to scan infrastructure as code for misconfigurations?▼

Yes, you can use Trivy to scan infrastructure as code for misconfigurations. It evaluates IaC files to identify security risks and policy violations before deployment, ensuring secure cloud workflows.

How do I prioritize vulnerability remediation using CVSS scores?▼

Prioritizing vulnerability remediation using CVSS scores involves filtering scan results based on severity. Trivy outputs CVSS-based metrics for identified CVEs, allowing teams to target the most critical container and dependency vulnerabilities first.

Does local filesystem vulnerability scanning work for dependencies without a container?▼

Yes, local filesystem vulnerability scanning works for dependencies without a container. Trivy can scan local filesystems directly to identify CVEs and license risks in project dependencies outside of containerized environments.

Related Skills

Explore More Software Engineering Skills→
igbuendigbuend
8

trivy

Execute Aqua Trivy security scans for vulnerabilities, secrets, and misconfigurations.

Community
Advanced
rohunjrohunj
232

sca-trivy

Scan container images, dependencies, and IaC for CVEs using Trivy.

Community
Advanced
AgentSecOpsAgentSecOps
183

container-grype

Scan container images and SBOMs for vulnerabilities with Grype.

Official
Advanced
jinyimeng01jinyimeng01
54

dependency-cve

Fingerprint application frameworks and library versions to identify vulnerable dependencies.

Community
Intermediate