[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG7PD50S23X81P9N2HDK0N":3,"skill-same:01M6AG7PD50S23X81P9N2HDK0N":131},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AG7PD50S23X81P9N2HDK0N","scanning-containers-with-trivy-in-cicd",null,"Integrates Aqua Security's Trivy scanner into CI\u002FCD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and to enforce severity-based quality gates that block vulnerable images from being deployed. Use when building Docker images in CI\u002FCD and needing automated vulnerability scanning and pass\u002Ffail gates before registry push or production deployment.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-containers-with-trivy-in-cicd\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"scanning containers with trivy in cicd","cicd","trivy","containers","push","vulnerability","t1195","vulnerability-scanning","severity","container-security","ci","issues","registry","git","pr","secure","dockerfile","cybersecurity","security","devsecops","2026-11-10 10:12:30",false,"---\nname: scanning-containers-with-trivy-in-cicd\ndescription: 'Integrates Aqua Security''s Trivy scanner into CI\u002FCD pipelines to detect\n  OS package and application dependency CVEs, Dockerfile misconfigurations, and issues\n  in filesystems or git repositories, and to enforce severity-based quality gates that\n  block vulnerable images from being deployed. Use when building Docker images in\n  CI\u002FCD and needing automated vulnerability scanning and pass\u002Ffail gates before registry\n  push or production deployment.\n\n  '\ndomain: cybersecurity\nsubdomain: devsecops\ntags:\n- devsecops\n- cicd\n- trivy\n- container-security\n- vulnerability-scanning\n- secure-sdlc\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- GV.SC-07\n- ID.IM-04\n- PR.PS-04\nmitre_attack:\n- T1195\n- T1554\n- T1059.004\n- T1610\n- T1611\n---\n\n# Scanning Containers with Trivy in CI\u002FCD\n\n## When to Use\n\n- When building Docker container images in CI\u002FCD and needing automated vulnerability scanning before registry push\n- When establishing quality gates that prevent images with critical or high CVEs from reaching production\n- When compliance requirements mandate vulnerability scanning of all container images before deployment\n- When scanning IaC files (Dockerfiles, Kubernetes manifests) alongside container image scanning\n- When needing a single tool to scan OS packages, language-specific dependencies, and misconfigurations\n\n**Do not use** for runtime container security monitoring (use Falco), for scanning running containers in production (use runtime agents), or when only scanning application source code without containerization (use SAST tools).\n\n## Prerequisites\n\n- Trivy CLI installed (v0.50+) or access to aquasecurity\u002Ftrivy-action GitHub Action\n- Docker daemon available in CI\u002FCD for building and scanning images\n- Container registry credentials for pulling base images and pushing scanned images\n- Trivy vulnerability database accessible (downloaded automatically or cached)\n\n## Workflow\n\n### Step 1: Configure Trivy Scanning in GitHub Actions\n\nSet up a GitHub Actions workflow that builds a Docker image and scans it with Trivy before pushing to a container registry.\n\n```yaml\n# .github\u002Fworkflows\u002Fcontainer-security.yml\nname: Container Security Scan\n\non:\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n    paths:\n      - 'Dockerfile'\n      - 'docker-compose*.yml'\n      - 'src\u002F**'\n      - 'requirements*.txt'\n      - 'package*.json'\n\njobs:\n  build-and-scan:\n    runs-on: ubuntu-latest\n    permissions:\n      security-events: write\n      contents: read\n\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build Docker image\n        run: docker build -t app:${{ github.sha }} .\n\n      - name: Run Trivy vulnerability scanner\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          image-ref: 'app:${{ github.sha }}'\n          format: 'sarif'\n          output: 'trivy-results.sarif'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n          ignore-unfixed: true\n\n      - name: Upload Trivy scan results\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        if: always()\n        with:\n          sarif_file: 'trivy-results.sarif'\n          category: 'trivy-container'\n\n      - name: Run Trivy misconfiguration scanner\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          scan-type: 'config'\n          scan-ref: '.'\n          format: 'table'\n          exit-code: '1'\n          severity: 'CRITICAL,HIGH'\n```\n\n### Step 2: Scan Dockerfiles for Misconfigurations\n\nTrivy detects common Dockerfile security issues such as running as root, using latest tags, and exposing unnecessary ports.\n\n```bash\n# Scan Dockerfile for misconfigurations\ntrivy config --severity HIGH,CRITICAL .\u002FDockerfile\n\n# Scan with custom policy directory\ntrivy config --policy .\u002Fsecurity-policies --severity MEDIUM,HIGH,CRITICAL .\n\n# Example secure Dockerfile practices Trivy checks for:\n# - USER instruction present (not running as root)\n# - HEALTHCHECK instruction defined\n# - Base image uses specific tag, not :latest\n# - No secrets in ENV or ARG instructions\n# - COPY preferred over ADD\n```\n\n### Step 3: Integrate with GitLab CI\u002FCD\n\n```yaml\n# .gitlab-ci.yml\nstages:\n  - build\n  - scan\n  - push\n\nvariables:\n  TRIVY_CACHE_DIR: .trivycache\u002F\n\nbuild:\n  stage: build\n  script:\n    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .\n    - docker save $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -o image.tar\n  artifacts:\n    paths:\n      - image.tar\n\ntrivy-scan:\n  stage: scan\n  image:\n    name: aquasec\u002Ftrivy:latest\n    entrypoint: [\"\"]\n  cache:\n    paths:\n      - .trivycache\u002F\n  script:\n    - trivy image\n        --input image.tar\n        --exit-code 1\n        --severity CRITICAL,HIGH\n        --ignore-unfixed\n        --format json\n        --output trivy-report.json\n    - trivy image\n        --input image.tar\n        --severity CRITICAL,HIGH,MEDIUM\n        --format table\n  artifacts:\n    reports:\n      container_scanning: trivy-report.json\n    paths:\n      - trivy-report.json\n  allow_failure: false\n\npush:\n  stage: push\n  needs: [trivy-scan]\n  script:\n    - docker load -i image.tar\n    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA\n```\n\n### Step 4: Configure Trivy Ignore and Exception Handling\n\nManage false positives and accepted risks through Trivy's ignore file and VEX statements.\n\n```yaml\n# .trivyignore.yaml\nvulnerabilities:\n  - id: CVE-2023-44487    # HTTP\u002F2 rapid reset - mitigated at load balancer\n    statement: \"Mitigated by WAF rate limiting at ingress layer\"\n    expires: 2026-06-01\n\n  - id: CVE-2024-21626    # runc container escape - patched in base image update\n    statement: \"Tracked in JIRA-SEC-1234, base image update scheduled\"\n    expires: 2026-03-15\n\nmisconfigurations:\n  - id: DS002             # User not set - required for init containers\n    paths:\n      - \"docker\u002Finit-container\u002FDockerfile\"\n    statement: \"Init container requires root for volume permission setup\"\n```\n\n### Step 5: Implement Database Caching and Offline Scanning\n\nCache the Trivy vulnerability database in CI\u002FCD to reduce scan times and enable air-gapped environments.\n\n```yaml\n# GitHub Actions with database caching\n- name: Cache Trivy DB\n  uses: actions\u002Fcache@v4\n  with:\n    path: \u002Ftmp\u002Ftrivy-db\n    key: trivy-db-${{ hashFiles('.github\u002Fworkflows\u002Fcontainer-security.yml') }}\n    restore-keys: trivy-db-\n\n- name: Run Trivy with cached DB\n  uses: aquasecurity\u002Ftrivy-action@0.28.0\n  with:\n    image-ref: 'app:${{ github.sha }}'\n    cache-dir: \u002Ftmp\u002Ftrivy-db\n    format: 'json'\n    output: 'trivy-results.json'\n    severity: 'CRITICAL,HIGH'\n    exit-code: '1'\n```\n\n```bash\n# Air-gapped: Download DB manually and mount\ntrivy image --download-db-only --cache-dir \u002Fpath\u002Fto\u002Fcache\n# Transfer cache to air-gapped system\ntrivy image --skip-db-update --cache-dir \u002Fpath\u002Fto\u002Fcache myimage:tag\n```\n\n### Step 6: Generate SBOM and Scan for License Compliance\n\nUse Trivy to generate Software Bill of Materials alongside vulnerability scanning.\n\n```bash\n# Generate SBOM in CycloneDX format\ntrivy image --format cyclonedx --output sbom.cdx.json app:latest\n\n# Generate SBOM in SPDX format\ntrivy image --format spdx-json --output sbom.spdx.json app:latest\n\n# Scan SBOM for vulnerabilities (decouple generation from scanning)\ntrivy sbom sbom.cdx.json --severity CRITICAL,HIGH\n\n# Scan with license detection\ntrivy image --scanners vuln,license --severity HIGH,CRITICAL app:latest\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| CVE | Common Vulnerabilities and Exposures — standardized identifiers for publicly known security vulnerabilities |\n| Vulnerability DB | Trivy's regularly updated database aggregating CVE data from NVD, vendor advisories, and language-specific sources |\n| Misconfiguration | Security-relevant configuration issue in Dockerfiles, Kubernetes manifests, or IaC templates |\n| SBOM | Software Bill of Materials — complete inventory of all components and dependencies in a container image |\n| Ignore Unfixed | Flag to skip CVEs without available patches, reducing noise from vulnerabilities with no actionable fix |\n| VEX | Vulnerability Exploitability eXchange — machine-readable statements about whether a vulnerability is exploitable in context |\n| Exit Code | Non-zero return code from Trivy when findings exceed the severity threshold, used to fail CI\u002FCD pipelines |\n\n## Tools & Systems\n\n- **Trivy**: Open-source vulnerability scanner by Aqua Security supporting images, filesystems, repos, and IaC\n- **trivy-action**: Official GitHub Action for running Trivy scans in GitHub Actions workflows\n- **Trivy Operator**: Kubernetes operator that continuously scans cluster workloads with Trivy\n- **Grype**: Alternative image scanner by Anchore for comparison and validation of scan results\n- **Harbor**: Container registry with built-in Trivy integration for automatic image scanning on push\n\n## Common Scenarios\n\n### Scenario: Multi-Stage Build with Separate Scan and Push\n\n**Context**: A team builds multi-stage Docker images and needs to scan the final production image before pushing to ECR, while also scanning the build stage for supply chain risks.\n\n**Approach**:\n1. Build the Docker image with `--target production` for the final stage\n2. Run Trivy with `--severity CRITICAL,HIGH --exit-code 1 --ignore-unfixed` to block on exploitable issues\n3. Generate an SBOM in CycloneDX format and store as a build artifact\n4. Upload SARIF results to GitHub Security tab for visibility\n5. Only push to ECR if the Trivy scan exits with code 0\n6. Tag the pushed image with the scan timestamp and Trivy DB version for audit traceability\n\n**Pitfalls**: Scanning only the final stage misses vulnerable packages that were present in build stages and may have influenced the build. Run `trivy fs` on the build context separately. Caching the Trivy DB too aggressively (weekly) means newly published CVEs take days to appear in scans.\n\n## Output Format\n\n```\nTrivy Container Scan Report\n=============================\nImage: app:a1b2c3d4\nBase Image: python:3.12-slim-bookworm\nScan Date: 2026-02-23\nDB Version: 2026-02-23T00:15:00Z\n\nVULNERABILITY SUMMARY:\n  Total: 47\n  Critical: 2\n  High: 5\n  Medium: 18\n  Low: 22\n  Unfixed: 8 (excluded from gate)\n\nCRITICAL FINDINGS:\n  CVE-2025-12345  libssl3    3.0.11-1  3.0.13-1  OpenSSL buffer overflow\n  CVE-2025-67890  curl       7.88.1-10 7.88.1-12 curl HSTS bypass\n\nHIGH FINDINGS:\n  CVE-2025-11111  zlib1g     1.2.13    1.2.13.1  zlib heap buffer overflow\n  CVE-2025-22222  python3.12 3.12.1    3.12.3    CPython path traversal\n  CVE-2025-33333  requests   2.31.0    2.32.0    requests SSRF in redirects\n\nMISCONFIGURATION:\n  DS002  [HIGH]   Dockerfile: USER instruction not set (running as root)\n  DS026  [MEDIUM] Dockerfile: No HEALTHCHECK defined\n\nQUALITY GATE: FAILED (2 Critical, 5 High findings)\n```\n","# Scanning Containers with Trivy in CI\u002FCD\n\n## When to Use\n\n- When building Docker container images in CI\u002FCD and needing automated vulnerability scanning before registry push\n- When establishing quality gates that prevent images with critical or high CVEs from reaching production\n- When compliance requirements mandate vulnerability scanning of all container images before deployment\n- When scanning IaC files (Dockerfiles, Kubernetes manifests) alongside container image scanning\n- When needing a single tool to scan OS packages, language-specific dependencies, and misconfigurations\n\n**Do not use** for runtime container security monitoring (use Falco), for scanning running containers in production (use runtime agents), or when only scanning application source code without containerization (use SAST tools).\n\n## Prerequisites\n\n- Trivy CLI installed (v0.50+) or access to aquasecurity\u002Ftrivy-action GitHub Action\n- Docker daemon available in CI\u002FCD for building and scanning images\n- Container registry credentials for pulling base images and pushing scanned images\n- Trivy vulnerability database accessible (downloaded automatically or cached)\n\n## Workflow\n\n### Step 1: Configure Trivy Scanning in GitHub Actions\n\nSet up a GitHub Actions workflow that builds a Docker image and scans it with Trivy before pushing to a container registry.\n\n```yaml\n# .github\u002Fworkflows\u002Fcontainer-security.yml\nname: Container Security Scan\n\non:\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n    paths:\n      - 'Dockerfile'\n      - 'docker-compose*.yml'\n      - 'src\u002F**'\n      - 'requirements*.txt'\n      - 'package*.json'\n\njobs:\n  build-and-scan:\n    runs-on: ubuntu-latest\n    permissions:\n      security-events: write\n      contents: read\n\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build Docker image\n        run: docker build -t app:${{ github.sha }} .\n\n      - name: Run Trivy vulnerability scanner\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          image-ref: 'app:${{ github.sha }}'\n          format: 'sarif'\n          output: 'trivy-results.sarif'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n          ignore-unfixed: true\n\n      - name: Upload Trivy scan results\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        if: always()\n        with:\n          sarif_file: 'trivy-results.sarif'\n          category: 'trivy-container'\n\n      - name: Run Trivy misconfiguration scanner\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          scan-type: 'config'\n          scan-ref: '.'\n          format: 'table'\n          exit-code: '1'\n          severity: 'CRITICAL,HIGH'\n```\n\n### Step 2: Scan Dockerfiles for Misconfigurations\n\nTrivy detects common Dockerfile security issues such as running as root, using latest tags, and exposing unnecessary ports.\n\n```bash\n# Scan Dockerfile for misconfigurations\ntrivy config --severity HIGH,CRITICAL .\u002FDockerfile\n\n# Scan with custom policy directory\ntrivy config --policy .\u002Fsecurity-policies --severity MEDIUM,HIGH,CRITICAL .\n\n# Example secure Dockerfile practices Trivy checks for:\n# - USER instruction present (not running as root)\n# - HEALTHCHECK instruction defined\n# - Base image uses specific tag, not :latest\n# - No secrets in ENV or ARG instructions\n# - COPY preferred over ADD\n```\n\n### Step 3: Integrate with GitLab CI\u002FCD\n\n```yaml\n# .gitlab-ci.yml\nstages:\n  - build\n  - scan\n  - push\n\nvariables:\n  TRIVY_CACHE_DIR: .trivycache\u002F\n\nbuild:\n  stage: build\n  script:\n    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .\n    - docker save $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -o image.tar\n  artifacts:\n    paths:\n      - image.tar\n\ntrivy-scan:\n  stage: scan\n  image:\n    name: aquasec\u002Ftrivy:latest\n    entrypoint: [\"\"]\n  cache:\n    paths:\n      - .trivycache\u002F\n  script:\n    - trivy image\n        --input image.tar\n        --exit-code 1\n        --severity CRITICAL,HIGH\n        --ignore-unfixed\n        --format json\n        --output trivy-report.json\n    - trivy image\n        --input image.tar\n        --severity CRITICAL,HIGH,MEDIUM\n        --format table\n  artifacts:\n    reports:\n      container_scanning: trivy-report.json\n    paths:\n      - trivy-report.json\n  allow_failure: false\n\npush:\n  stage: push\n  needs: [trivy-scan]\n  script:\n    - docker load -i image.tar\n    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA\n```\n\n### Step 4: Configure Trivy Ignore and Exception Handling\n\nManage false positives and accepted risks through Trivy's ignore file and VEX statements.\n\n```yaml\n# .trivyignore.yaml\nvulnerabilities:\n  - id: CVE-2023-44487    # HTTP\u002F2 rapid reset - mitigated at load balancer\n    statement: \"Mitigated by WAF rate limiting at ingress layer\"\n    expires: 2026-06-01\n\n  - id: CVE-2024-21626    # runc container escape - patched in base image update\n    statement: \"Tracked in JIRA-SEC-1234, base image update scheduled\"\n    expires: 2026-03-15\n\nmisconfigurations:\n  - id: DS002             # User not set - required for init containers\n    paths:\n      - \"docker\u002Finit-container\u002FDockerfile\"\n    statement: \"Init container requires root for volume permission setup\"\n```\n\n### Step 5: Implement Database Caching and Offline Scanning\n\nCache the Trivy vulnerability database in CI\u002FCD to reduce scan times and enable air-gapped environments.\n\n```yaml\n# GitHub Actions with database caching\n- name: Cache Trivy DB\n  uses: actions\u002Fcache@v4\n  with:\n    path: \u002Ftmp\u002Ftrivy-db\n    key: trivy-db-${{ hashFiles('.github\u002Fworkflows\u002Fcontainer-security.yml') }}\n    restore-keys: trivy-db-\n\n- name: Run Trivy with cached DB\n  uses: aquasecurity\u002Ftrivy-action@0.28.0\n  with:\n    image-ref: 'app:${{ github.sha }}'\n    cache-dir: \u002Ftmp\u002Ftrivy-db\n    format: 'json'\n    output: 'trivy-results.json'\n    severity: 'CRITICAL,HIGH'\n    exit-code: '1'\n```\n\n```bash\n# Air-gapped: Download DB manually and mount\ntrivy image --download-db-only --cache-dir \u002Fpath\u002Fto\u002Fcache\n# Transfer cache to air-gapped system\ntrivy image --skip-db-update --cache-dir \u002Fpath\u002Fto\u002Fcache myimage:tag\n```\n\n### Step 6: Generate SBOM and Scan for License Compliance\n\nUse Trivy to generate Software Bill of Materials alongside vulnerability scanning.\n\n```bash\n# Generate SBOM in CycloneDX format\ntrivy image --format cyclonedx --output sbom.cdx.json app:latest\n\n# Generate SBOM in SPDX format\ntrivy image --format spdx-json --output sbom.spdx.json app:latest\n\n# Scan SBOM for vulnerabilities (decouple generation from scanning)\ntrivy sbom sbom.cdx.json --severity CRITICAL,HIGH\n\n# Scan with license detection\ntrivy image --scanners vuln,license --severity HIGH,CRITICAL app:latest\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| CVE | Common Vulnerabilities and Exposures — standardized identifiers for publicly known security vulnerabilities |\n| Vulnerability DB | Trivy's regularly updated database aggregating CVE data from NVD, vendor advisories, and language-specific sources |\n| Misconfiguration | Security-relevant configuration issue in Dockerfiles, Kubernetes manifests, or IaC templates |\n| SBOM | Software Bill of Materials — complete inventory of all components and dependencies in a container image |\n| Ignore Unfixed | Flag to skip CVEs without available patches, reducing noise from vulnerabilities with no actionable fix |\n| VEX | Vulnerability Exploitability eXchange — machine-readable statements about whether a vulnerability is exploitable in context |\n| Exit Code | Non-zero return code from Trivy when findings exceed the severity threshold, used to fail CI\u002FCD pipelines |\n\n## Tools & Systems\n\n- **Trivy**: Open-source vulnerability scanner by Aqua Security supporting images, filesystems, repos, and IaC\n- **trivy-action**: Official GitHub Action for running Trivy scans in GitHub Actions workflows\n- **Trivy Operator**: Kubernetes operator that continuously scans cluster workloads with Trivy\n- **Grype**: Alternative image scanner by Anchore for comparison and validation of scan results\n- **Harbor**: Container registry with built-in Trivy integration for automatic image scanning on push\n\n## Common Scenarios\n\n### Scenario: Multi-Stage Build with Separate Scan and Push\n\n**Context**: A team builds multi-stage Docker images and needs to scan the final production image before pushing to ECR, while also scanning the build stage for supply chain risks.\n\n**Approach**:\n1. Build the Docker image with `--target production` for the final stage\n2. Run Trivy with `--severity CRITICAL,HIGH --exit-code 1 --ignore-unfixed` to block on exploitable issues\n3. Generate an SBOM in CycloneDX format and store as a build artifact\n4. Upload SARIF results to GitHub Security tab for visibility\n5. Only push to ECR if the Trivy scan exits with code 0\n6. Tag the pushed image with the scan timestamp and Trivy DB version for audit traceability\n\n**Pitfalls**: Scanning only the final stage misses vulnerable packages that were present in build stages and may have influenced the build. Run `trivy fs` on the build context separately. Caching the Trivy DB too aggressively (weekly) means newly published CVEs take days to appear in scans.\n\n## Output Format\n\n```\nTrivy Container Scan Report\n=============================\nImage: app:a1b2c3d4\nBase Image: python:3.12-slim-bookworm\nScan Date: 2026-02-23\nDB Version: 2026-02-23T00:15:00Z\n\nVULNERABILITY SUMMARY:\n  Total: 47\n  Critical: 2\n  High: 5\n  Medium: 18\n  Low: 22\n  Unfixed: 8 (excluded from gate)\n\nCRITICAL FINDINGS:\n  CVE-2025-12345  libssl3    3.0.11-1  3.0.13-1  OpenSSL buffer overflow\n  CVE-2025-67890  curl       7.88.1-10 7.88.1-12 curl HSTS bypass\n\nHIGH FINDINGS:\n  CVE-2025-11111  zlib1g     1.2.13    1.2.13.1  zlib heap buffer overflow\n  CVE-2025-22222  python3.12 3.12.1    3.12.3    CPython path traversal\n  CVE-2025-33333  requests   2.31.0    2.32.0    requests SSRF in redirects\n\nMISCONFIGURATION:\n  DS002  [HIGH]   Dockerfile: USER instruction not set (running as root)\n  DS026  [MEDIUM] Dockerfile: No HEALTHCHECK defined\n\nQUALITY GATE: FAILED (2 Critical, 5 High findings)\n```\n",{"name":5,"tags":52,"author":54,"domain":44,"license":15,"version":55,"nist_csf":56,"subdomain":46,"description":61,"mitre_attack":62},[46,28,29,36,34,53],"secure-sdlc","mahipal","1.0.0",[57,58,59,60],"PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04","Integrates Aqua Security's Trivy scanner into CI\u002FCD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and to enforce severity-based quality gates that block vulnerable images from being deployed. Use when building Docker images in CI\u002FCD and needing automated vulnerability scanning and pass\u002Ffail gates before registry push or production deployment.\n",[63,64,65,66,67],"T1195","T1554","T1059.004","T1610","T1611","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fscanning-containers-with-trivy-in-cicd",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill scanning-containers-with-trivy-in-cicd",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill scanning-containers-with-trivy-in-cicd",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill scanning-containers-with-trivy-in-cicd","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-containers-with-trivy-in-cicd\u002FSKILL.md",true,[92,98,103,109,113,117,123,127],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",4949,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-containers-with-trivy-in-cicd\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-containers-with-trivy-in-cicd\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",1951,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-containers-with-trivy-in-cicd\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",2729,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-containers-with-trivy-in-cicd\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",4264,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-containers-with-trivy-in-cicd\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",6226,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-containers-with-trivy-in-cicd\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",12006,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-containers-with-trivy-in-cicd\u002Fscripts\u002Fprocess.py",{"path":128,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":129,"sourceHtmlUrl":130},"test-cases.json",8723,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fsuperpowers\u002Fskills\u002Fusing-live-documentation\u002Ftest-cases.json",[132,155,179,207,232,258],{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":139,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[138],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[140,141,142,143,45,44,144,145,41,146,147,37,148,149,150,33,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","supply-chain","pipeline","supply-chain-security","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[163,151,164,165,45,166,44,41,167,168,169,170,171,172,173,174,175,176,177,178],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[173,190,191,192,193,44,194,195,167,196,197,198,199,200,201,202,203,204,205,206],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,44,39,218,219,220,221,222,223,224,225,226,227,228,170,229,230,231],"windows","kape","triaging windows with kape","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[238],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,44,243,244,245,246,247,248,249,250,251,252,253,32,254,255,256,257],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","api","prioritization","ssvc","decision-tree",{"skillNo":259,"name":260,"nameZh":6,"description":261,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":262,"categories":263,"keywords":265,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[264],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[45,266,44,267,268,269,270,271,272,35,273,202,274,203,275,276,277,278,279,280],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]