skills.rest
yu-iskw
yu-iskwCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-vulnerability-audit

Audits security vulnerabilities using Trunk CLI, Trivy and OSV-scanner.

1|Updated Feb 10, 2026
Search Tags:#security#vulnerability#audit#trivy#trunk#osv-scanner
One-click install
npx skills add https://github.com/yu-iskw/lightdash-tools --skill security-vulnerability-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-vulnerability-audit
Source: https://github.com/yu-iskw/lightdash-tools/tree/main/.claude/skills/security-vulnerability-audit
Command: npx skills add https://github.com/yu-iskw/lightdash-tools --skill security-vulnerability-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the process of identifying and reporting security vulnerabilities within a codebase, helping to maintain a secure software development lifecycle.

Core Features & Use Cases

  • Automated Scanning: Leverages Trunk CLI with Trivy and OSV-scanner to detect vulnerabilities.
  • Finding Analysis: Provides guidance on interpreting scan results, focusing on critical issues and hard-coded secrets.
  • Reporting: Outlines a structured format for reporting security findings.
  • Use Case: Before merging a new feature branch, run this skill to ensure no new critical vulnerabilities or exposed secrets have been introduced.

Quick Start

Run the project's security linting script to audit for vulnerabilities.

Frequently Asked Questions about security-vulnerability-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my project for security vulnerabilities and hard-coded secrets?▼

To audit security vulnerabilities, you can run the `pnpm run lint:security` command, which uses Trunk CLI, Trivy, and OSV-scanner to detect critical dependency vulnerabilities and hard-coded secrets in your codebase.

What is the best way to scan dependencies for vulnerabilities before merging a feature branch?▼

Using Trunk CLI with Trivy and OSV-scanner is an effective way to scan dependencies for vulnerabilities before a merge, ensuring no new critical issues or exposed secrets have been introduced into the codebase.

Can I use Trivy and OSV-scanner together for a comprehensive codebase security analysis?▼

Yes, you can use Trivy and OSV-scanner together through Trunk CLI to perform a comprehensive security analysis, identifying both critical dependency vulnerabilities and hard-coded secrets within your project.

Do I need pnpm to run the security vulnerability audit?▼

Yes, you need pnpm installed in your environment to execute the `pnpm run lint:security` command, which is required to trigger the automated scanning process using Trunk CLI, Trivy, and OSV-scanner.

How does Trunk CLI report security findings after a vulnerability scan?▼

Trunk CLI reports security findings by providing guidance on interpreting scan results from Trivy and OSV-scanner, focusing on critical issues and hard-coded secrets, and outlining a structured format for reporting.

Related Skills

Explore More Software Engineering Skills→
FernanSuozaFernanSuoza

sec-security-vulnerability-analysis

Scan dependencies, secrets, containers, and IaC for vulnerabilities.

Community
Advanced
jiayaoqijiajiayaoqijia
98

scan

Run Semgrep, Trivy, osv-scanner, and Bandit to identify security vulnerabilities.

Community
Intermediate
adaptive-enforcement-labadaptive-enforcement-lab
3

security-scanning-workflows

Automate SAST, dependency, and container security scans in CI/CD pipelines.

Official
Advanced
matteocervellimatteocervelli
25

security-scanner

Scan codebases for secrets, vulnerable dependencies, and insecure patterns.

Community
Advanced