trivy-security-scan

Scan container images, filesystems, Git repos, and Kubernetes for vulnerabilities and misconfigurations.

17|5|Updated Feb 1, 2026

Search Tags:#security #kubernetes #license #secrets #vulnerabilities #trivy #misconfigurations

Ready to run

npx skills add https://github.com/alxayo/sec-check --skill trivy-security-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: trivy-security-scan
Source: https://github.com/alxayo/sec-check/tree/main/.github/skills/trivy-security-scan
Command: npx skills add https://github.com/alxayo/sec-check --skill trivy-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cloud-native security scanning across containers, infrastructure-as-code (IaC), and Kubernetes to detect vulnerabilities, misconfigurations, secrets, and license issues before deploys.

Core Features & Use Cases

CVE and vulnerability detection for OS packages, language dependencies, and image layers
IaC misconfiguration checks for Terraform, CloudFormation, Kubernetes manifests, Helm charts, and Dockerfiles
Secrets and license compliance scanning across codebases and configs
SBOM generation and multi-target scans to support DevSecOps pipelines

Quick Start

Install and run Trivy to scan images, filesystems, Git repositories, and Kubernetes manifests for security issues.

Frequently Asked Questions about trivy-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan Kubernetes manifests and Dockerfiles for misconfigurations?▼

Vulnerability and CVE detection scans OS packages, language dependencies, and container image layers to identify known security issues. This prevents deploying images with vulnerable software components in cloud-native environments.

Can I generate SBOM and output security scan results in SARIF or SPDX format?▼

Yes, security scans support SBOM generation and output results in JSON, SARIF, and SPDX formats. This enables seamless CI/CD integration by providing standardized vulnerability, misconfiguration, and license reports.

How do I detect hardcoded secrets and license compliance issues in my codebase?▼

Secret and license scanning analyzes codebases and configurations to detect exposed credentials and license compliance issues. This prevents accidental secret leaks and ensures legal compliance across cloud-native artifacts.

Does Trivy work for scanning remote Git repositories and Kubernetes clusters?▼

Yes, Trivy supports multiple scan targets including remote Git repositories and Kubernetes clusters. This allows comprehensive security analysis of vulnerabilities, misconfigurations, and secrets across diverse cloud-native environments.

What is the best way to automate pre-deployment security gates for container images?▼

Automate pre-deployment security gates by integrating CLI-based scans into your CI/CD pipelines to check container images, IaC, and filesystems. This blocks risky code deployment by identifying vulnerabilities, secrets, and misconfigurations.