メニュー
Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill implementing-aqua-security-for-container-scanningコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
SKILL.md を表示中
| name | implementing-aqua-security-for-container-scanning |
| description | Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries. |
| domain | cybersecurity |
| subdomain | devsecops |
| tags | ["aqua-security","trivy","container-scanning","vulnerability-scanning","sbom","image-security","supply-chain"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"] |
| mitre_attack | ["T1195","T1554","T1059.004","T1610","T1611"] |
Aqua Security provides Trivy, the world's most popular open-source universal security scanner, designed to find vulnerabilities, misconfigurations, secrets, SBOM data, and license issues in containers, Kubernetes, code repositories, and cloud environments. Trivy covers OS packages (Alpine, Debian, Ubuntu, RHEL, etc.) and language-specific dependencies (npm, pip, Maven, Go modules, Cargo, etc.) with vulnerability databases sourced from NVD, vendor advisories, and GitHub Security Advisories. The enterprise Aqua Platform extends Trivy with centralized policy management, runtime protection, and compliance reporting.
trivy) or Trivy Operator for KubernetesTrivy scans container images layer by layer, identifying CVEs in OS packages and application dependencies. It supports scanning local images, remote registry images, and tar archives.
# Scan a remote image
trivy image python:3.11-slim
# Scan with severity filter
trivy image --severity HIGH,CRITICAL nginx:latest
# Scan and fail CI if critical CVEs found
trivy image --exit-code 1 --severity CRITICAL myapp:latest
# Generate SBOM in CycloneDX format
trivy image --format cyclonedx --output sbom.json myapp:latest
# Scan project directory for vulnerabilities in dependencies
trivy fs --scanners vuln,secret,misconfig .
# Scan a specific lockfile
trivy fs --scanners vuln package-lock.json
# Scan git repository
trivy repo https://github.com/org/project
The Trivy Operator runs inside a Kubernetes cluster and continuously scans workloads:
# Install Trivy Operator via Helm
helm repo add aqua https://aquasecurity.github.io/helm-charts/
helm repo update
helm install trivy-operator aqua/trivy-operator \
--namespace trivy-system \
--create-namespace \
--set trivy.severity="HIGH,CRITICAL" \
--set operator.scanJobTimeout="5m"
The operator creates VulnerabilityReport and ConfigAuditReport custom resources for each workload.
# Scan Terraform files
trivy config --severity HIGH,CRITICAL ./terraform/
# Scan Dockerfile for misconfigurations
trivy config Dockerfile
# Scan Kubernetes manifests
trivy config ./k8s-manifests/
name: Container Security Scan
on:
push:
branches: [main]
pull_request:
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Build Docker image
run: docker build -t myapp:${{ github.sha }} .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: 'myapp:${{ github.sha }}'
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH'
exit-code: '1'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: 'trivy-results.sarif'
container_scanning:
stage: security
image:
name: aquasec/trivy:latest
entrypoint: [""]
variables:
FULL_IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
script:
- trivy image --exit-code 0 --format template --template "@/contrib/gitlab.tpl"
--output gl-container-scanning-report.json $FULL_IMAGE_NAME
- trivy image --exit-code 1 --severity CRITICAL $FULL_IMAGE_NAME
artifacts:
reports:
container_scanning: gl-container-scanning-report.json
pipeline {
agent any
stages {
stage('Build') {
steps {
sh 'docker build -t myapp:${BUILD_NUMBER} .'
}
}
stage('Security Scan') {
steps {
sh '''
trivy image --exit-code 1 \
--severity HIGH,CRITICAL \
--format json \
--output trivy-report.json \
myapp:${BUILD_NUMBER}
'''
}
post {
always {
archiveArtifacts artifacts: 'trivy-report.json'
}
}
}
}
}
Create .trivy/policy.rego for custom policy enforcement:
package trivy
deny[msg] {
input.Results[_].Vulnerabilities[_].Severity == "CRITICAL"
msg := "Critical vulnerabilities found in image"
}
deny[msg] {
input.Results[_].Vulnerabilities[vuln]
vuln.FixedVersion != ""
vuln.Severity == "HIGH"
msg := sprintf("Fixable HIGH vulnerability: %s", [vuln.VulnerabilityID])
}
Create .trivyignore for accepted risks:
# Accepted risk: vulnerability in test dependency only
CVE-2023-12345
# Accepted until expiry date
CVE-2024-67890 exp:2025-06-01
# Generate CycloneDX SBOM
trivy image --format cyclonedx --output sbom-cyclonedx.json myapp:latest
# Generate SPDX SBOM
trivy image --format spdx-json --output sbom-spdx.json myapp:latest
# Scan an existing SBOM for new vulnerabilities
trivy sbom sbom-cyclonedx.json
| Metric | Description | Target |
|---|---|---|
| Images scanned per day | Total images passing through scanning pipeline | All production images |
| Critical CVE count | Open critical vulnerabilities across all images | 0 in production |
| Mean time to patch | Average days from CVE publication to patched image | < 7 days |
| SBOM coverage | Percentage of production images with generated SBOMs | 100% |
| Scan duration | Average time per image scan | < 2 minutes |