image-vulnerability-report

name	image-vulnerability-report
enabled	true
description	Use when performing image vulnerability report — generates a detailed vulnerability report for container images across a registry or set of repositories. This template aggregates scan results, tracks remediation progress, and provides executive-level summaries of the organization's container security posture over time.
required_connections	[{"prefix":"registry","label":"Container Registry"},{"prefix":"scanner","label":"Vulnerability Scanner"}]
config_fields	[{"key":"registry_url","label":"Registry URL","required":true,"placeholder":"e.g., gcr.io/my-project"},{"key":"report_scope","label":"Report Scope","required":true,"placeholder":"e.g., All production images"},{"key":"reporting_period","label":"Reporting Period","required":false,"placeholder":"e.g., March 2026"}]
features	["VULNERABILITY_REPORT","CONTAINER_SECURITY","SRE_OPS"]

Image Vulnerability Report

Phase 1: Inventory

Enumerate all images in scope.

• Total images in registry: ___
• Images actively deployed in production: ___
• Images with latest scan <7 days old: ___
• Images never scanned: ___
• Images with no active deployments (candidates for cleanup): ___

Image Repository	Tags	Last Scan	Deployed	Base OS

Phase 2: Vulnerability Aggregation

Aggregate findings across all scanned images.

Fleet-wide Summary:

Severity	Total Findings	Unique CVEs	Fix Available (%)	Images Affected
Critical
High
Medium
Low

Top 10 Most Common CVEs:

CVE ID	Severity	Package	Images Affected	Fix Available	Age (days)

Phase 3: Risk Assessment

• Identify images with Critical/High CVEs that are internet-facing
• Cross-reference CVEs against known exploit databases (CISA KEV)
• Assess blast radius for each critical finding
• Identify shared base images that amplify risk

Risk Matrix:

Risk Level	Criteria
Critical	Known exploited CVE in internet-facing production image
High	Critical CVE with fix available in production image
Medium	High CVE in production or Critical in non-production
Low	Medium/Low CVE or finding in non-production only

Phase 4: Trend Analysis

Compare to previous reporting period.

Metric	Previous Period	Current Period	Trend
Total Critical CVEs
Total High CVEs
Mean time to remediate (Critical)
Mean time to remediate (High)
Images with zero Critical/High
Scan coverage (%)

Phase 5: Remediation Tracking

CVE/Finding	Affected Images	Owner	Status	Target Date	Notes

Counter-Rationalizations

Shortcut	Counter	Why
"We can skip some steps for this case"	Adapt the workflow steps, don't skip them	Skipped steps are where incidents and oversights originate
"The user seems to already know what to do"	Complete all workflow phases with the user	The workflow catches blind spots that experience alone misses
"This is a minor case, full process is overkill"	Scale the process down, don't turn it off	Minor cases become major when unstructured; the process scales, not disappears
"I'll fill in the details later"	Complete each section before moving on	Deferred details are forgotten; real-time capture is more accurate
"The template output isn't necessary"	Always produce the structured output format	Structured output enables comparison, audit trails, and handoff to other teams

Output Format

Executive Summary

• Total images scanned: ___
• Scan coverage: ___%
• Critical findings requiring immediate action: ___
• Mean time to remediate (Critical): ___ days
• Security posture trend: Improving / Stable / Declining

Action Items

• Remediate all Critical CVEs with known exploits within 48 hours
• Patch remaining Critical CVEs within 7 days
• Scan all unscanned images and add to pipeline
• Clean up unused images from registry
• Update shared base images to patched versions
• Report posture to security leadership