skills.rest
ductoanoxo
ductoanoxoCOMMUNITY
Explore all skills by this author →
GitHub

Trivy Security Scanning

Scan projects for vulnerabilities, secrets, misconfigurations, and licenses using Trivy.

3|Updated May 3, 2026
Search Tags:#vulnerabilities#security scanning#misconfiguration#secrets detection#trivy#license audit
One-click install
npx skills add https://github.com/ductoanoxo/Agent_SQL --skill trivy-security-scanning
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Trivy Security Scanning
Source: https://github.com/ductoanoxo/Agent_SQL/tree/main/.agents/skills/security/trivy
Command: npx skills add https://github.com/ductoanoxo/Agent_SQL --skill trivy-security-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you detect security vulnerabilities, leaked secrets, and insecure configuration patterns before they reach production, reducing the risk of breaches and compliance issues.

Core Features & Use Cases

  • Vulnerability scanning: Run Trivy to check dependency and filesystem risks or scan specific container images for HIGH/CRITICAL findings.
  • Secret leak detection: Scan the codebase for hardcoded credentials, tokens, and other sensitive data using the secret scanner.
  • Misconfiguration auditing: Use Trivy config checks against Dockerfiles and IaC to catch insecure or non-compliant settings.
  • License review: Identify potential prohibited or incompatible licenses in the project dependencies.
  • CI/reporting readiness: Export scan results in JSON for structured analysis and easier review in automated pipelines.

Quick Start

Tell the AI agent: Scan the repository for HIGH and CRITICAL vulnerabilities and provide actionable remediation guidance.

Frequently Asked Questions about Trivy Security Scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Docker image for HIGH and CRITICAL vulnerabilities?▼

Secret detection with Trivy scans the codebase filesystem to identify hardcoded credentials, tokens, and sensitive data, reducing the risk of leaked secrets reaching production environments.

How do I scan a Docker image for HIGH and CRITICAL vulnerabilities?▼

Vulnerability scanning with Trivy checks container images for HIGH and CRITICAL findings by executing targeted scan commands, then interprets the results to recommend specific fixes for exposed dependencies.

Can I audit Dockerfiles and IaC for misconfigurations?▼

Misconfiguration auditing with Trivy runs config checks against Dockerfiles and infrastructure-as-code files to catch insecure or non-compliant settings before they reach production deployments.

How do I check project dependencies for incompatible licenses?▼

Misconfiguration auditing with Trivy runs config checks against Dockerfiles and infrastructure-as-code files to catch insecure or non-compliant settings before they reach production deployments.

How do I export security scan results for CI pipeline reporting?▼

Trivy scanning produces machine-readable JSON output for structured analysis, enabling easier review and integration of vulnerability, secret, and misconfiguration findings within automated CI pipelines.

Related Skills

Explore More Software Engineering Skills→
kobogithubkobogithub

security-trivy

Automate security scanning of container images, filesystems, and Infrastructure as Code with Trivy.

Community
Intermediate
SherifEldeebSherifEldeeb
5

vulnerability-management

Process Nessus, Qualys, and CSV scan results to prioritize and track vulnerability remediation.

Community
Basic
alirezarezvanialirezarezvani
24.2k

senior-secops

Automate security scanning, vulnerability assessment, and compliance checks with Python scripts.

Community
Intermediate
kivo360kivo360
1

moai-domain-security

Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.

Community
Advanced