# Scan Dependencies and Containers with Trivy

Security teams need consistent visibility into vulnerable components, images, and infrastructure configuration. This skill provides practical Trivy workflows for assessment, reporting, and remediation.

## Install

```bash
npx skillstore add agentsecops/sca-trivy
```

## Metadata

- Status: approved
- Slug: agentsecops-sca-trivy
- Version: 0.1.0
- Author version: 0.1.0
- Skillstore revision: r2
- Version status: valid
- Tree hash: d7ad82743949f55281e6e1924460d1f34227911b59679f66fba67740f5b5e795
- Author: AgentSecOps
- GitHub username: AgentSecOps
- License: MIT
- Repository: https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/sca-trivy
- Ref: 181fdefcafd96b041926e61c4b2e306ca7e7820e
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/agentsecops-sca-trivy
- Manifest: https://skillstore.pages.dev/api/skills/agentsecops-sca-trivy/manifest

## Capabilities

- Provides Trivy commands for container images, project filesystems, package manifests, and infrastructure configuration.
- Explains severity filtering and review steps for CVE remediation.
- Shows CycloneDX and SPDX SBOM generation commands.
- Includes GitHub Actions and GitLab CI integration examples.
- Covers cache, offline scanning, ignore files, authentication, and common troubleshooting.

## Use Cases

- Review Project Dependencies: Scan application manifests, prioritize vulnerable packages, and identify fixed versions before release.
- Build a CI Security Gate: Add Trivy scanning, SARIF reporting, severity thresholds, and controlled exceptions to a delivery pipeline.
- Prepare Supply Chain Evidence: Generate SBOMs and summarize vulnerability or license findings for governance reviews.

## Prompt Templates

### Scan a Project

```
Scan the current project with Trivy for HIGH and CRITICAL dependency vulnerabilities. Summarize affected packages, fixed versions, and recommended updates.
```

### Assess a Container Image

```
Assess container image [image:tag] with Trivy. Prioritize exploitable vulnerabilities and recommend patched packages or a safer base image.
```

### Review Infrastructure Configuration

```
Review [IaC path] with Trivy configuration scanning. Group misconfigurations by severity and propose precise changes without modifying files.
```

### Design an Advanced CI Gate

```
Design a CI security gate for [platform] using Trivy SARIF output, immutable action references, severity thresholds, exceptions, and artifact retention.
```

## Limitations

- Requires Trivy and, for some workflows, Docker or registry access.
- Does not include the scripts, references, or assets named in the document.
- Does not execute scans or verify remediation without access to the target environment.
- Results depend on Trivy database freshness, package metadata, and available manifests.

## Best Practices

- Scan immutable image digests and record the Trivy database version.
- Treat scan reports and SBOMs as sensitive artifacts with restricted retention.
- Validate every suppression with ownership, expiration, and documented compensating controls.

## Anti Patterns

- Do not rely only on severity while ignoring exploitability and deployment context.
- Do not pass registry passwords on command lines or store them in project files.
- Do not use mutable CI action branches or unpinned container tags in security gates.

## Security Audit

- Audited at: 2026-07-23T06:59:47.802\+00:00
- Summary: All 73 static findings are false positives caused by Markdown code fences, inline code, reference links, and documented configuration paths. Semantic review found mutable CI references, credential exposure guidance, and an ineffective custom-policy gate. These examples require hardening before publication.

## Stats

- Views: 318
- Downloads: 15
- Favorites: 0
- Popularity score: 0