trivy

Scan filesystems, images, and IaC files for CRITICAL and HIGH vulnerabilities before deployment.

13|1|Updated Jan 9, 2026

Search Tags:#vulnerability #IaC #pre-commit #security scanning #container #trivy #sbom

Ready to run

npx skills add https://github.com/mauromedda/agent-toolkit --skill trivy

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: trivy
Source: https://github.com/mauromedda/agent-toolkit/tree/main/skills/trivy
Command: npx skills add https://github.com/mauromedda/agent-toolkit --skill trivy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps ensure code and infrastructure are scanned for security vulnerabilities before they are committed, preventing exposure of vulnerable dependencies and misconfigurations.

Core Features & Use Cases

Pre-commit Security Scans: Run Trivy on filesystem, images, and IaC changes to catch vulnerabilities early.
CI/CD Integration: Integrate scans into pipelines to fail builds on CRITICAL/HIGH findings.
Remediation Aids: Provide guidance on upgrading dependencies and generating SBOMs for compliance.
Use Case: Imagine you modify a Terraform file or update package.json; this skill will detect vulnerabilities in dependencies or configurations before deployment.

Quick Start

Use this skill to perform a filesystem scan in your project: trivy fs --severity CRITICAL,HIGH --exit-code 1 .

Frequently Asked Questions about trivy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan for security vulnerabilities before a git commit?▼

To scan for security vulnerabilities before a commit, run a filesystem scan on your project directory to detect CRITICAL and HIGH findings. This approach catches misconfigurations and vulnerable dependencies early by enforcing an exit code one failure on detection.

What is Trivy used for in a CI pipeline?▼

Trivy is used in a CI pipeline to scan filesystem, container images, and IaC configurations for security vulnerabilities. It enforces build failures upon detecting CRITICAL or HIGH severity issues and optionally generates an SBOM for compliance.

Can I scan container images and IaC files for misconfigurations?▼

Yes, you can scan container images and IaC files for misconfigurations using configuration and image scanning modes. This process identifies security vulnerabilities in infrastructure definitions and container layers before deployment.

Do I need to install Trivy separately to run pre-commit security scans?▼

Yes, you need to have Trivy installed separately to run pre-commit security scans. The skill requires this underlying installation to execute filesystem, image, and config scans for detecting vulnerable dependencies and infrastructure changes.

How do I generate an SBOM for my project dependencies?▼

You can generate an SBOM for your project dependencies during security scanning to ensure compliance. This optional feature runs alongside vulnerability detection to map out all software components in your filesystem or container images.

Why should I use pre-commit security scanning instead of only scanning in production?▼

Pre-commit security scanning prevents exposure of vulnerable dependencies and misconfigurations by catching them locally before deployment. Scanning only in production delays detection, whereas early filesystem and IaC scans provide immediate remediation guidance.