sca-trivy

Scan containers, dependencies, and IaC for vulnerabilities with Trivy.

Updated Aug 23, 2026

Search Tags:#trivy #sbom #sca #container-security #vulnerability-scanning #dependency-scanning #iac-security

Ready to run

npx skills add https://github.com/mirandagabrieldev/claude-build-template --skill sca-trivy-mirandagabrieldev

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sca-trivy
Source: https://github.com/mirandagabrieldev/claude-build-template/tree/main/skills/security/sca-trivy
Command: npx skills add https://github.com/mirandagabrieldev/claude-build-template --skill sca-trivy-mirandagabrieldev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Trivy-based SCA and vulnerability scanning for containers, IaC, and dependencies to help teams identify CVEs, misconfigurations, license risks, and prioritize remediation.

Core Features & Use Cases

Container image vulnerability assessment
Dependency vulnerability scanning
IaC security checks
SBOM generation
CI/CD integration with SARIF
Remediation prioritization by CVSS

Quick Start

Run a Trivy scan on a container image or filesystem and generate a SARIF report to begin vulnerability assessment.

Frequently Asked Questions about sca-trivy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan container images for vulnerabilities and generate a SARIF report?▼

Scanning container images for vulnerabilities involves running a Trivy scan against the image and outputting the results as a SARIF report. This process identifies CVEs and provides remediation guidance for CI/CD integration.

What is SBOM generation and when do I need CycloneDX or SPDX formats?▼

SBOM generation creates a formal inventory of software components and dependencies. You need CycloneDX or SPDX formats when standardizing dependency tracking for compliance or when integrating vulnerability scanning into automated security workflows.

Can I use Trivy to scan infrastructure as code for misconfigurations?▼

Yes, you can use Trivy to scan infrastructure as code for misconfigurations. It evaluates IaC files to identify security risks and policy violations before deployment, ensuring secure cloud workflows.

How do I prioritize vulnerability remediation using CVSS scores?▼

Prioritizing vulnerability remediation using CVSS scores involves filtering scan results based on severity. Trivy outputs CVSS-based metrics for identified CVEs, allowing teams to target the most critical container and dependency vulnerabilities first.

Does local filesystem vulnerability scanning work for dependencies without a container?▼

Yes, local filesystem vulnerability scanning works for dependencies without a container. Trivy can scan local filesystems directly to identify CVEs and license risks in project dependencies outside of containerized environments.