| name | trivy-vulnerability-scanner |
| description | 用于通过 Trivy 扫描仓库、容器镜像、文件系统、rootfs、SBOM、Kubernetes、IaC、密钥、许可证和系统 CVE。 |
| zh_description | 用于通过 Trivy 扫描仓库、容器镜像、文件系统、rootfs、SBOM、Kubernetes、IaC、密钥、许可。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, vulnerability-scanning, cve, container-security, kubernetes, sbom, iac, secrets] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | advanced |
Trivy Vulnerability Scanner
Trigger / When to Use
Use this skill when the user asks to scan a codebase, container image, Linux root filesystem, Kubernetes cluster, SBOM, or repository for CVEs, misconfigurations, exposed secrets, or license risks with Trivy.
Good trigger phrases:
- "scan this Docker image for CVEs"
- "run Trivy on this repo"
- "check Kubernetes manifests for vulnerabilities"
- "generate a SARIF vulnerability report"
- "scan a Linux rootfs or container filesystem"
- "fail CI on critical fixable CVEs"
Core Capabilities
- Vulnerability scanning for OS packages and application dependencies.
- Container image scanning from local engines or remote registries.
- Filesystem and root filesystem scanning for source trees and unpacked images.
- Repository scanning for git URLs or local project directories.
- Kubernetes scanning for cluster and resource risk review.
- IaC misconfiguration checks for Kubernetes YAML, Dockerfiles, Terraform, and related config.
- Secret scanning for committed tokens, keys, and credentials.
- License scanning and SPDX/CycloneDX SBOM workflows.
- SARIF, JSON, table, template, and GitHub-friendly reporting.
Workflow
1. Identify the Target
Classify the target before running commands:
- Source repository: use
trivy repo or trivy fs.
- Container image: use
trivy image.
- Unpacked root filesystem: use
trivy rootfs.
- Kubernetes cluster or manifests: use
trivy k8s or trivy config.
- SBOM file: use
trivy sbom.
- VM image or filesystem archive: prefer image/rootfs modes when supported.
Ask only if the target is ambiguous and a wrong scan could be destructive or very slow. Otherwise choose the narrowest safe scan mode.
2. Install or Verify Trivy
trivy --version
If missing, recommend the official installation path for the user's OS. Avoid piping remote install scripts into a privileged shell unless the user explicitly approves.
3. Run a Baseline Scan
Use a read-only baseline first:
trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --ignore-unfixed .
For a container image:
