Agent skill · security · aiskillstore
sca-trivy
Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license compliance risks. Use when: (1) Scanning container images and filesystems for vulnerabilities and misconfigurations, (2) Analyzing dependencies for known CVEs across multiple languages (Go, Python, Node.js, Java, etc.), (3) Detecting IaC security issues in Terraform, Kubernetes, Dockerfile, (4) Integrating vulnerability scanning into CI/CD pipelines with SARIF output, (5) Generating Software Bill of Materials (SBOM) in CycloneDX or SPDX format, (6) Prioritizing remediation by CVSS score and exploitability.
Why this skill is useful
Adds executable scripts for comprehensive vulnerability scanning and remediation workflows that aren't in public docs.
What it needs
Requires docker, trivy installed locally. About 7k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Software Composition Analysis with Trivy Overview Trivy is a comprehensive security scanner for containers, filesystems, and git repositories. It detects vulnerabilities (CVEs) in OS packages and application dependencies, IaC misconfigurations, exposed secrets, and software licenses. This skill provides workflows for vulnerability scanning, SBOM generation, CI/CD integration, and remediation prioritization aligned with CVSS and OWASP standards. Quick Start Scan a container image for vulnerabilities: Core Workflows Workflow 1: Container Image Security Assessment Progress: [ ] 1. Identify target container image (repository:tag) [ ] 2. Run comprehensive Trivy scan with trivy image <image-name> [ ] 3. Analyze vulnerability findings by severity (CRITICAL, HIGH, MEDIUM, LOW) [ ] 4. Map CVE findings to CWE categories and OWASP references [ ] 5. Check for available patches and updated base images [ ] 6. Generate prioritized remediation report with upgrade recommendations Work through each step systematically. Check off completed items. Workflow 2: Dependency Vulnerability Scanning Scan project dependencies for known vulnerabilities: For each vulnerability: 1. Review CVE details and CVSS score 2. Check if fixed version is available 3. Consult references/remediationguide.md for language-specific guidance 4. Update dependency to patched version 5. Re-scan to validate fix Workflow 3: Infrastructure as Code Security Detect misconfigurations in IaC files: Review findings by category: Security: Authentication, authorization, encryption Compliance: CIS benchmarks, security standards Best Practices: Resource limits, immutability, least privilege Workflow 4: CI/CD Pipeline Integration GitHub Actions GitLab CI Use bundled templates from assets/ciintegration/ for additional platforms. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/sca-trivy