Trivy Security Scanning

What problem does it solve?

This Skill helps you detect security vulnerabilities, leaked secrets, and insecure configuration patterns before they reach production, reducing the risk of breaches and compliance issues.

Core Features & Use Cases

• Vulnerability scanning: Run Trivy to check dependency and filesystem risks or scan specific container images for HIGH/CRITICAL findings.
• Secret leak detection: Scan the codebase for hardcoded credentials, tokens, and other sensitive data using the secret scanner.
• Misconfiguration auditing: Use Trivy config checks against Dockerfiles and IaC to catch insecure or non-compliant settings.
• License review: Identify potential prohibited or incompatible licenses in the project dependencies.
• CI/reporting readiness: Export scan results in JSON for structured analysis and easier review in automated pipelines.

Quick Start

Tell the AI agent: Scan the repository for HIGH and CRITICAL vulnerabilities and provide actionable remediation guidance.