Agent skill · security · aiskillstore
container-grype
Container vulnerability scanning and dependency risk assessment using Grype with CVSS severity ratings, EPSS exploit probability, and CISA KEV indicators. Use when: (1) Scanning container images and filesystems for known vulnerabilities, (2) Integrating vulnerability scanning into CI/CD pipelines with severity thresholds, (3) Analyzing SBOMs (Syft, SPDX, CycloneDX) for security risks, (4) Prioritizing remediation based on threat metrics (CVSS, EPSS, KEV), (5) Generating vulnerability reports in multiple formats (JSON, SARIF, CycloneDX) for security toolchain integration.
Why this skill is useful
Provides specific commands and workflows for integrating Grype into CI/CD pipelines and prioritizing vulnerabilities based on threat metrics.
What it needs
Requires docker, grype installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Container Vulnerability Scanning with Grype Overview Grype is an open-source vulnerability scanner that identifies known security flaws in container images, filesystems, and Software Bill of Materials (SBOM) documents. It analyzes operating system packages (Alpine, Ubuntu, Red Hat, Debian) and language-specific dependencies (Java, Python, JavaScript, Ruby, Go, PHP, Rust) against vulnerability databases to detect CVEs. Grype emphasizes actionable security insights through: CVSS severity ratings for risk classification EPSS exploit probability scores for threat assessment CISA Known Exploited Vulnerabilities (KEV) indicators Multiple output formats (table, JSON, SARIF, CycloneDX) for toolchain integration Quick Start Scan a container image: Examples: Core Workflow Basic Vulnerability Scan 1. Identify scan target: Determine what to scan (container image, filesystem, SBOM) 2. Run Grype scan: Execute grype <target> to analyze for vulnerabilities 3. Review findings: Examine CVE IDs, severity, CVSS scores, affected packages 4. Prioritize remediation: Focus on critical/high severity, CISA KEV, high EPSS scores 5. Apply fixes: Update vulnerable packages or base images 6. Re-scan: Verify vulnerabilities are resolved CI/CD Integration with Fail Thresholds For automated pipeline security gates: Pipeline integration pattern: 1. Build container image 2. Run Grype scan with --fail-on threshold 3. If scan fails: Block deployment, alert security team 4. If scan passes: Continue deployment workflow 5. Archive scan results as build artifacts SBOM-Based Scanning Use Grype with Syft-generated SBOMs for faster re-scanning: Benefits of SBOM workflow: Faster re-scans without re-analyzing image layers Share SBOMs across security tools Archive SBOMs for compliance and auditing Risk Prioritization Workflow Progress: [ ] 1. Run full Grype scan with JSON output: grype <target> -o json > results.json [ ] 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/container-grype