skills.rest
alxayo
alxayoCOMMUNITY
Explore all skills by this author →
GitHub

trivy-security-scan

Scan container images, filesystems, Git repos, and Kubernetes for vulnerabilities and misconfigurations.

17|5|Updated Feb 1, 2026
Search Tags:#security#kubernetes#license#secrets#vulnerabilities#trivy#misconfigurations
One-click install
npx skills add https://github.com/alxayo/sec-check --skill trivy-security-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: trivy-security-scan
Source: https://github.com/alxayo/sec-check/tree/main/.github/skills/trivy-security-scan
Command: npx skills add https://github.com/alxayo/sec-check --skill trivy-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cloud-native security scanning across containers, infrastructure-as-code (IaC), and Kubernetes to detect vulnerabilities, misconfigurations, secrets, and license issues before deploys.

Core Features & Use Cases

  • CVE and vulnerability detection for OS packages, language dependencies, and image layers
  • IaC misconfiguration checks for Terraform, CloudFormation, Kubernetes manifests, Helm charts, and Dockerfiles
  • Secrets and license compliance scanning across codebases and configs
  • SBOM generation and multi-target scans to support DevSecOps pipelines

Quick Start

Install and run Trivy to scan images, filesystems, Git repositories, and Kubernetes manifests for security issues.

Frequently Asked Questions about trivy-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Kubernetes manifests and Dockerfiles for misconfigurations?▼

Vulnerability and CVE detection scans OS packages, language dependencies, and container image layers to identify known security issues. This prevents deploying images with vulnerable software components in cloud-native environments.

Can I generate SBOM and output security scan results in SARIF or SPDX format?▼

Yes, security scans support SBOM generation and output results in JSON, SARIF, and SPDX formats. This enables seamless CI/CD integration by providing standardized vulnerability, misconfiguration, and license reports.

How do I detect hardcoded secrets and license compliance issues in my codebase?▼

Secret and license scanning analyzes codebases and configurations to detect exposed credentials and license compliance issues. This prevents accidental secret leaks and ensures legal compliance across cloud-native artifacts.

Does Trivy work for scanning remote Git repositories and Kubernetes clusters?▼

Yes, Trivy supports multiple scan targets including remote Git repositories and Kubernetes clusters. This allows comprehensive security analysis of vulnerabilities, misconfigurations, and secrets across diverse cloud-native environments.

What is the best way to automate pre-deployment security gates for container images?▼

Automate pre-deployment security gates by integrating CLI-based scans into your CI/CD pipelines to check container images, IaC, and filesystems. This blocks risky code deployment by identifying vulnerabilities, secrets, and misconfigurations.

Related Skills

Explore More Software Engineering Skills→
reverb256reverb256

kubernetes-architect

Design and maintain Kubernetes clusters with GitOps and service mesh.

Community
Advanced
AgentSecOpsAgentSecOps
183

container-grype

Scan container images and SBOMs for vulnerabilities with Grype.

Official
Advanced
pluginagentmarketplacepluginagentmarketplace
3

devops-cloud-skills

Automate cloud infrastructure provisioning with Terraform, Docker, and Kubernetes.

Community
Advanced
devendrapratapsinghdevendrapratapsingh
1

platform-security

Audit container images, Kubernetes configurations, cloud environments, and infrastructure as code for security vulnerabilities.

Community
Advanced