[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG90887XYBAP72RK1VHXWG":3,"skill-same:01M6AG90887XYBAP72RK1VHXWG":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":29,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AG90887XYBAP72RK1VHXWG","securing-container-registry-images",null,"Secures container registry images (ECR, ACR, GCR, Docker Hub) by scanning with Trivy and Grype, signing with Cosign and Sigstore, configuring registry access controls, and building CI\u002FCD pipelines that block unscanned or unsigned images. Use when establishing registry security controls or enforcing scan\u002Fsignature checks before image promotion.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-container-registry-images\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"securing container registry images","registry","cloud-security","image-scanning","cosign","sigstore","trivy","t1078","grype","supply-chain","image","ci","cloud","pr","cybersecurity","security","docker","containers","2026-11-10 10:12:30",false,"---\nname: securing-container-registry-images\ndescription: 'Secures container registry images (ECR, ACR, GCR, Docker Hub) by scanning\n  with Trivy and Grype, signing with Cosign and Sigstore, configuring registry access\n  controls, and building CI\u002FCD pipelines that block unscanned or unsigned images.\n  Use when establishing registry security controls or enforcing scan\u002Fsignature checks\n  before image promotion.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- containers\n- registry\n- image-scanning\n- trivy\n- cosign\n- supply-chain\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1610\n---\n\n# Securing Container Registry Images\n\n## When to Use\n\n- When establishing security controls for container image registries (ECR, ACR, GCR, Docker Hub)\n- When building CI\u002FCD pipelines that enforce vulnerability scanning before image promotion\n- When implementing image signing and verification to prevent supply chain attacks\n- When auditing existing registries for vulnerable, unscanned, or unsigned images\n- When compliance requires software bill of materials (SBOM) for deployed container images\n\n**Do not use** for runtime container security (use Falco or Sysdig), for Kubernetes admission control (use OPA Gatekeeper or Kyverno after establishing registry controls), or for host-level vulnerability scanning (use Amazon Inspector or Qualys).\n\n## Prerequisites\n\n- Trivy installed (`brew install trivy` or `apt install trivy`)\n- Grype installed (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh`)\n- Cosign installed for image signing (`go install github.com\u002Fsigstore\u002Fcosign\u002Fv2\u002Fcmd\u002Fcosign@latest`)\n- Syft installed for SBOM generation (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fsyft\u002Fmain\u002Finstall.sh | sh`)\n- Container registry access (ECR, ACR, GCR, or private registry)\n\n## Workflow\n\n### Step 1: Scan Images for Vulnerabilities with Trivy\n\nRun comprehensive vulnerability scans against container images before and after pushing to the registry.\n\n```bash\n# Scan a local image for vulnerabilities\ntrivy image --severity HIGH,CRITICAL myapp:latest\n\n# Scan a remote registry image\ntrivy image --severity HIGH,CRITICAL 123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Scan with JSON output for CI\u002FCD processing\ntrivy image --format json --output trivy-results.json myapp:latest\n\n# Scan for vulnerabilities AND misconfigurations\ntrivy image --scanners vuln,misconfig,secret myapp:latest\n\n# Scan a specific image with SBOM output\ntrivy image --format spdx-json --output sbom.json myapp:latest\n\n# Fail CI\u002FCD if critical vulnerabilities found\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\n```\n\n### Step 2: Scan with Grype for Additional Coverage\n\nUse Grype as a complementary scanner for broader vulnerability database coverage.\n\n```bash\n# Scan image with Grype\ngrype myapp:latest\n\n# Scan with severity threshold\ngrype myapp:latest --fail-on critical\n\n# Output in JSON for processing\ngrype myapp:latest -o json > grype-results.json\n\n# Scan an SBOM instead of the image directly\nsyft myapp:latest -o spdx-json > sbom.json\ngrype sbom:sbom.json\n\n# Scan a directory-based image export\ngrype dir:\u002Fpath\u002Fto\u002Fimage-rootfs\n```\n\n### Step 3: Generate Software Bill of Materials (SBOM)\n\nCreate SBOMs for all images to maintain an inventory of software components and dependencies.\n\n```bash\n# Generate SBOM with Syft in SPDX format\nsyft myapp:latest -o spdx-json > sbom-spdx.json\n\n# Generate SBOM in CycloneDX format\nsyft myapp:latest -o cyclonedx-json > sbom-cyclonedx.json\n\n# Attach SBOM to the image as an OCI artifact\ncosign attach sbom --sbom sbom-spdx.json \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify SBOM contents\nsyft myapp:latest -o table | head -50\n```\n\n### Step 4: Sign Images with Cosign and Sigstore\n\nImplement image signing to ensure image integrity and authenticity in the supply chain.\n\n```bash\n# Generate a key pair for signing\ncosign generate-key-pair\n\n# Sign an image in the registry\ncosign sign --key cosign.key \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Sign using keyless signing with Sigstore (OIDC-based)\ncosign sign --yes \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify image signature\ncosign verify --key cosign.pub \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify keyless signature\ncosign verify \\\n  --certificate-identity developer@company.com \\\n  --certificate-oidc-issuer https:\u002F\u002Faccounts.google.com \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Add attestation with scan results\ncosign attest --predicate trivy-results.json \\\n  --key cosign.key \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n```\n\n### Step 5: Configure Registry-Level Security Controls\n\nSet up registry-specific security features for ECR, ACR, and GCR.\n\n```bash\n# AWS ECR: Enable image scanning on push\naws ecr put-image-scanning-configuration \\\n  --repository-name myapp \\\n  --image-scanning-configuration scanOnPush=true\n\n# ECR: Set image tag immutability (prevent tag overwrites)\naws ecr put-image-tag-mutability \\\n  --repository-name myapp \\\n  --image-tag-mutability IMMUTABLE\n\n# ECR: Set lifecycle policy to clean up untagged images\naws ecr put-lifecycle-policy \\\n  --repository-name myapp \\\n  --lifecycle-policy-text '{\n    \"rules\": [{\n      \"rulePriority\": 1,\n      \"description\": \"Remove untagged images after 7 days\",\n      \"selection\": {\"tagStatus\": \"untagged\", \"countType\": \"sinceImagePushed\", \"countUnit\": \"days\", \"countNumber\": 7},\n      \"action\": {\"type\": \"expire\"}\n    }]\n  }'\n\n# ECR: Get scan findings for an image\naws ecr describe-image-scan-findings \\\n  --repository-name myapp \\\n  --image-id imageTag=latest \\\n  --query 'imageScanFindings.findingSeverityCounts'\n\n# Azure ACR: Enable Defender for container registries\naz security pricing create --name ContainerRegistry --tier standard\n\n# GCR: Enable Container Analysis\ngcloud services enable containeranalysis.googleapis.com\ngcloud artifacts docker images list-vulnerabilities \\\n  LOCATION-docker.pkg.dev\u002FPROJECT\u002FREPO\u002FIMAGE@sha256:DIGEST\n```\n\n### Step 6: Build CI\u002FCD Pipeline with Security Gates\n\nIntegrate scanning and signing into the CI\u002FCD pipeline as mandatory gates.\n\n```yaml\n# GitHub Actions: Scan, sign, and push image\nname: Container Security Pipeline\non: push\n\njobs:\n  build-scan-sign:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Trivy vulnerability scan\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: json\n          output: trivy-results.json\n          severity: CRITICAL,HIGH\n          exit-code: 1\n\n      - name: Generate SBOM\n        run: syft myapp:${{ github.sha }} -o spdx-json > sbom.json\n\n      - name: Push to ECR\n        run: |\n          aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_REGISTRY\n          docker tag myapp:${{ github.sha }} $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n          docker push $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n\n      - name: Sign image with Cosign\n        run: |\n          cosign sign --key env:\u002F\u002FCOSIGN_PRIVATE_KEY \\\n            $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n\n      - name: Attach SBOM\n        run: |\n          cosign attach sbom --sbom sbom.json \\\n            $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Container Image Scanning | Automated analysis of container image layers to identify known vulnerabilities in OS packages and application dependencies |\n| Image Signing | Cryptographic attestation that verifies the authenticity and integrity of a container image using Cosign or Notation |\n| SBOM | Software Bill of Materials, a comprehensive inventory of software components, libraries, and dependencies in a container image |\n| Tag Immutability | Registry setting that prevents overwriting existing image tags, ensuring that a tag always refers to the same image digest |\n| Sigstore | Open-source project providing keyless signing, transparency logs, and verification tooling for software supply chain security |\n| Image Attestation | Cryptographically signed metadata attached to an image (scan results, SBOM, build provenance) that can be verified before deployment |\n\n## Tools & Systems\n\n- **Trivy**: Comprehensive vulnerability scanner for container images, filesystems, git repos, and Kubernetes resources\n- **Grype**: Anchore's vulnerability scanner with broad vulnerability database coverage for container images and SBOMs\n- **Cosign**: Sigstore tool for signing, verifying, and attesting container images with key-based or keyless workflows\n- **Syft**: SBOM generation tool supporting SPDX and CycloneDX formats for container images and filesystems\n- **AWS ECR**: Container registry with built-in scanning, tag immutability, and lifecycle policies\n\n## Common Scenarios\n\n### Scenario: Implementing a Secure Image Promotion Pipeline\n\n**Context**: A development team pushes images to a dev registry without security controls. The security team needs to implement a promotion pipeline that scans, signs, and promotes only approved images to the production registry.\n\n**Approach**:\n1. Configure ECR scanning on push for the development repository\n2. Add Trivy scanning as a CI\u002FCD gate that blocks images with CRITICAL vulnerabilities\n3. Generate SBOMs with Syft and store alongside image scan results\n4. Sign approved images with Cosign after scanning passes\n5. Configure the production registry to require image signatures for all pushes\n6. Set up Kyverno or OPA Gatekeeper in production Kubernetes to verify signatures before pod creation\n7. Implement lifecycle policies to clean up untagged and old images in both registries\n\n**Pitfalls**: Vulnerability databases are updated constantly. An image that passes scanning today may have new CRITICAL vulnerabilities discovered tomorrow. Implement continuous scanning of already-deployed images, not just at build time. Image signing keys must be securely stored in KMS or Vault, not in CI\u002FCD environment variables.\n\n## Output Format\n\n```\nContainer Registry Security Report\n=====================================\nRegistry: 123456789012.dkr.ecr.us-east-1.amazonaws.com\nRepositories: 24\nReport Date: 2026-02-23\n\nIMAGE INVENTORY:\n  Total images: 342\n  Images scanned: 298 (87%)\n  Images signed: 156 (46%)\n  Images with SBOM: 134 (39%)\n\nVULNERABILITY SUMMARY:\n  Critical vulnerabilities:    23 (across 8 images)\n  High vulnerabilities:       145 (across 34 images)\n  Medium vulnerabilities:     456 (across 67 images)\n  Images with no vulns:       89\n\nCRITICAL IMAGES REQUIRING REMEDIATION:\n  myapp:1.2.3           - 5 CRITICAL (CVE-2026-xxxx in openssl)\n  api-gateway:2.0.1     - 3 CRITICAL (CVE-2026-yyyy in log4j)\n  worker:latest         - 4 CRITICAL (CVE-2026-zzzz in glibc)\n\nREGISTRY CONFIGURATION:\n  Scan on push enabled:     18 \u002F 24 repositories\n  Tag immutability:         12 \u002F 24 repositories\n  Lifecycle policies:       20 \u002F 24 repositories\n  Image signing enforced:    8 \u002F 24 repositories\n```\n","# Securing Container Registry Images\n\n## When to Use\n\n- When establishing security controls for container image registries (ECR, ACR, GCR, Docker Hub)\n- When building CI\u002FCD pipelines that enforce vulnerability scanning before image promotion\n- When implementing image signing and verification to prevent supply chain attacks\n- When auditing existing registries for vulnerable, unscanned, or unsigned images\n- When compliance requires software bill of materials (SBOM) for deployed container images\n\n**Do not use** for runtime container security (use Falco or Sysdig), for Kubernetes admission control (use OPA Gatekeeper or Kyverno after establishing registry controls), or for host-level vulnerability scanning (use Amazon Inspector or Qualys).\n\n## Prerequisites\n\n- Trivy installed (`brew install trivy` or `apt install trivy`)\n- Grype installed (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh`)\n- Cosign installed for image signing (`go install github.com\u002Fsigstore\u002Fcosign\u002Fv2\u002Fcmd\u002Fcosign@latest`)\n- Syft installed for SBOM generation (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fsyft\u002Fmain\u002Finstall.sh | sh`)\n- Container registry access (ECR, ACR, GCR, or private registry)\n\n## Workflow\n\n### Step 1: Scan Images for Vulnerabilities with Trivy\n\nRun comprehensive vulnerability scans against container images before and after pushing to the registry.\n\n```bash\n# Scan a local image for vulnerabilities\ntrivy image --severity HIGH,CRITICAL myapp:latest\n\n# Scan a remote registry image\ntrivy image --severity HIGH,CRITICAL 123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Scan with JSON output for CI\u002FCD processing\ntrivy image --format json --output trivy-results.json myapp:latest\n\n# Scan for vulnerabilities AND misconfigurations\ntrivy image --scanners vuln,misconfig,secret myapp:latest\n\n# Scan a specific image with SBOM output\ntrivy image --format spdx-json --output sbom.json myapp:latest\n\n# Fail CI\u002FCD if critical vulnerabilities found\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\n```\n\n### Step 2: Scan with Grype for Additional Coverage\n\nUse Grype as a complementary scanner for broader vulnerability database coverage.\n\n```bash\n# Scan image with Grype\ngrype myapp:latest\n\n# Scan with severity threshold\ngrype myapp:latest --fail-on critical\n\n# Output in JSON for processing\ngrype myapp:latest -o json > grype-results.json\n\n# Scan an SBOM instead of the image directly\nsyft myapp:latest -o spdx-json > sbom.json\ngrype sbom:sbom.json\n\n# Scan a directory-based image export\ngrype dir:\u002Fpath\u002Fto\u002Fimage-rootfs\n```\n\n### Step 3: Generate Software Bill of Materials (SBOM)\n\nCreate SBOMs for all images to maintain an inventory of software components and dependencies.\n\n```bash\n# Generate SBOM with Syft in SPDX format\nsyft myapp:latest -o spdx-json > sbom-spdx.json\n\n# Generate SBOM in CycloneDX format\nsyft myapp:latest -o cyclonedx-json > sbom-cyclonedx.json\n\n# Attach SBOM to the image as an OCI artifact\ncosign attach sbom --sbom sbom-spdx.json \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify SBOM contents\nsyft myapp:latest -o table | head -50\n```\n\n### Step 4: Sign Images with Cosign and Sigstore\n\nImplement image signing to ensure image integrity and authenticity in the supply chain.\n\n```bash\n# Generate a key pair for signing\ncosign generate-key-pair\n\n# Sign an image in the registry\ncosign sign --key cosign.key \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Sign using keyless signing with Sigstore (OIDC-based)\ncosign sign --yes \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify image signature\ncosign verify --key cosign.pub \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify keyless signature\ncosign verify \\\n  --certificate-identity developer@company.com \\\n  --certificate-oidc-issuer https:\u002F\u002Faccounts.google.com \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Add attestation with scan results\ncosign attest --predicate trivy-results.json \\\n  --key cosign.key \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n```\n\n### Step 5: Configure Registry-Level Security Controls\n\nSet up registry-specific security features for ECR, ACR, and GCR.\n\n```bash\n# AWS ECR: Enable image scanning on push\naws ecr put-image-scanning-configuration \\\n  --repository-name myapp \\\n  --image-scanning-configuration scanOnPush=true\n\n# ECR: Set image tag immutability (prevent tag overwrites)\naws ecr put-image-tag-mutability \\\n  --repository-name myapp \\\n  --image-tag-mutability IMMUTABLE\n\n# ECR: Set lifecycle policy to clean up untagged images\naws ecr put-lifecycle-policy \\\n  --repository-name myapp \\\n  --lifecycle-policy-text '{\n    \"rules\": [{\n      \"rulePriority\": 1,\n      \"description\": \"Remove untagged images after 7 days\",\n      \"selection\": {\"tagStatus\": \"untagged\", \"countType\": \"sinceImagePushed\", \"countUnit\": \"days\", \"countNumber\": 7},\n      \"action\": {\"type\": \"expire\"}\n    }]\n  }'\n\n# ECR: Get scan findings for an image\naws ecr describe-image-scan-findings \\\n  --repository-name myapp \\\n  --image-id imageTag=latest \\\n  --query 'imageScanFindings.findingSeverityCounts'\n\n# Azure ACR: Enable Defender for container registries\naz security pricing create --name ContainerRegistry --tier standard\n\n# GCR: Enable Container Analysis\ngcloud services enable containeranalysis.googleapis.com\ngcloud artifacts docker images list-vulnerabilities \\\n  LOCATION-docker.pkg.dev\u002FPROJECT\u002FREPO\u002FIMAGE@sha256:DIGEST\n```\n\n### Step 6: Build CI\u002FCD Pipeline with Security Gates\n\nIntegrate scanning and signing into the CI\u002FCD pipeline as mandatory gates.\n\n```yaml\n# GitHub Actions: Scan, sign, and push image\nname: Container Security Pipeline\non: push\n\njobs:\n  build-scan-sign:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Trivy vulnerability scan\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: json\n          output: trivy-results.json\n          severity: CRITICAL,HIGH\n          exit-code: 1\n\n      - name: Generate SBOM\n        run: syft myapp:${{ github.sha }} -o spdx-json > sbom.json\n\n      - name: Push to ECR\n        run: |\n          aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_REGISTRY\n          docker tag myapp:${{ github.sha }} $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n          docker push $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n\n      - name: Sign image with Cosign\n        run: |\n          cosign sign --key env:\u002F\u002FCOSIGN_PRIVATE_KEY \\\n            $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n\n      - name: Attach SBOM\n        run: |\n          cosign attach sbom --sbom sbom.json \\\n            $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Container Image Scanning | Automated analysis of container image layers to identify known vulnerabilities in OS packages and application dependencies |\n| Image Signing | Cryptographic attestation that verifies the authenticity and integrity of a container image using Cosign or Notation |\n| SBOM | Software Bill of Materials, a comprehensive inventory of software components, libraries, and dependencies in a container image |\n| Tag Immutability | Registry setting that prevents overwriting existing image tags, ensuring that a tag always refers to the same image digest |\n| Sigstore | Open-source project providing keyless signing, transparency logs, and verification tooling for software supply chain security |\n| Image Attestation | Cryptographically signed metadata attached to an image (scan results, SBOM, build provenance) that can be verified before deployment |\n\n## Tools & Systems\n\n- **Trivy**: Comprehensive vulnerability scanner for container images, filesystems, git repos, and Kubernetes resources\n- **Grype**: Anchore's vulnerability scanner with broad vulnerability database coverage for container images and SBOMs\n- **Cosign**: Sigstore tool for signing, verifying, and attesting container images with key-based or keyless workflows\n- **Syft**: SBOM generation tool supporting SPDX and CycloneDX formats for container images and filesystems\n- **AWS ECR**: Container registry with built-in scanning, tag immutability, and lifecycle policies\n\n## Common Scenarios\n\n### Scenario: Implementing a Secure Image Promotion Pipeline\n\n**Context**: A development team pushes images to a dev registry without security controls. The security team needs to implement a promotion pipeline that scans, signs, and promotes only approved images to the production registry.\n\n**Approach**:\n1. Configure ECR scanning on push for the development repository\n2. Add Trivy scanning as a CI\u002FCD gate that blocks images with CRITICAL vulnerabilities\n3. Generate SBOMs with Syft and store alongside image scan results\n4. Sign approved images with Cosign after scanning passes\n5. Configure the production registry to require image signatures for all pushes\n6. Set up Kyverno or OPA Gatekeeper in production Kubernetes to verify signatures before pod creation\n7. Implement lifecycle policies to clean up untagged and old images in both registries\n\n**Pitfalls**: Vulnerability databases are updated constantly. An image that passes scanning today may have new CRITICAL vulnerabilities discovered tomorrow. Implement continuous scanning of already-deployed images, not just at build time. Image signing keys must be securely stored in KMS or Vault, not in CI\u002FCD environment variables.\n\n## Output Format\n\n```\nContainer Registry Security Report\n=====================================\nRegistry: 123456789012.dkr.ecr.us-east-1.amazonaws.com\nRepositories: 24\nReport Date: 2026-02-23\n\nIMAGE INVENTORY:\n  Total images: 342\n  Images scanned: 298 (87%)\n  Images signed: 156 (46%)\n  Images with SBOM: 134 (39%)\n\nVULNERABILITY SUMMARY:\n  Critical vulnerabilities:    23 (across 8 images)\n  High vulnerabilities:       145 (across 34 images)\n  Medium vulnerabilities:     456 (across 67 images)\n  Images with no vulns:       89\n\nCRITICAL IMAGES REQUIRING REMEDIATION:\n  myapp:1.2.3           - 5 CRITICAL (CVE-2026-xxxx in openssl)\n  api-gateway:2.0.1     - 3 CRITICAL (CVE-2026-yyyy in log4j)\n  worker:latest         - 4 CRITICAL (CVE-2026-zzzz in glibc)\n\nREGISTRY CONFIGURATION:\n  Scan on push enabled:     18 \u002F 24 repositories\n  Tag immutability:         12 \u002F 24 repositories\n  Lifecycle policies:       20 \u002F 24 repositories\n  Image signing enforced:    8 \u002F 24 repositories\n```\n",{"name":5,"tags":53,"author":54,"domain":44,"license":15,"version":55,"nist_csf":56,"subdomain":32,"description":61,"mitre_attack":62},[32,47,31,33,36,34,39],"mahipal","1.0",[57,58,59,60],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Secures container registry images (ECR, ACR, GCR, Docker Hub) by scanning with Trivy and Grype, signing with Cosign and Sigstore, configuring registry access controls, and building CI\u002FCD pipelines that block unscanned or unsigned images. Use when establishing registry security controls or enforcing scan\u002Fsignature checks before image promotion.\n",[63,64,65,66,67],"T1078.004","T1530","T1537","T1580","T1610","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fsecuring-container-registry-images",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill securing-container-registry-images",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill securing-container-registry-images",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill securing-container-registry-images","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-container-registry-images\u002FSKILL.md",true,[92,97,103],{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-container-registry-images\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",1987,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-container-registry-images\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",8151,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-container-registry-images\u002Fscripts\u002Fagent.py",[110,131,155,182,207,234],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":48},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[116],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[35,118,119,120,45,44,121,122,43,123,124,41,39,125,126,127,128,129,34,130],"provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","pipeline","supply-chain-security","t1195","attestation","code-signing","keyless",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":48},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[137],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[139,128,140,141,45,142,44,43,143,144,145,146,147,148,149,150,151,152,153,154],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":48},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[161,164],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[149,166,167,168,169,44,170,171,143,172,173,174,175,176,177,37,178,179,180,181],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":48},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,44,31,193,194,195,196,197,198,199,200,201,202,203,146,204,205,206],"windows","kape","triaging windows with kape","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":48},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[213],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,44,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":48},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[240],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[45,242,44,243,244,245,246,247,248,249,250,37,251,178,252,253,254,255,256,257],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]