| name | container-scan |
| description | Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs. |
| argument-hint | [--paths Dockerfile1 Dockerfile2] [--image registry/img:tag] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["container scan","dockerfile","containerfile","scan image"] |
| chain | ["verify-fix"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix Container Scan Skill
Use when
- Pre-build: scan a Dockerfile for misconfigurations and base-image CVEs.
- PR review: detect EOL base images, missing USER, root processes, exposed secrets.
--image registry/img:tag: scan a built image for installed-package CVEs via Trivy/Grype if available.- Compose with Syft to produce a container SBOM (CycloneDX JSON).
- Hardening checklist: USER directive present, healthcheck defined, pinned versions, layer minimisation.
Don't use for
- Source-code SAST — use
/vulnetix:sast-scan.
- Cloud-config (Terraform / k8s manifests) — use
/vulnetix:iac-scan.
- Vulnetix CLI itself does not pull images; for
--image you need binaries.docker or binaries.podman.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Note: binaries.{docker,podman,trivy,grype,syft}, repo.{dockerfile,containerfile,compose,docker_compose}. If no container artifacts found AND no --image argument, abort with a one-liner.
Step 2: Run Vulnetix container analysis
vulnetix containers --paths "$DOCKERFILE_PATHS" -o json > .vulnetix/containers.${TIMESTAMP}.json
Or:
vulnetix scan --enable-containers --paths "$DOCKERFILE_PATHS" -o json
Captures: base-image risk, EOL bases, exposed secrets, missing USER, root processes, missing healthchecks, vulnerable system packages.
