菜单
Comprehensive security scanner for filesystems, container images, and IaC. Detects known CVEs in dependencies, hardcoded secrets, and IaC misconfigurations in Terraform, Kubernetes, Dockerfiles, and CloudFormation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Python AST-based security analysis using Bandit. Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography. Use for Python security audits, malicious code triage.
Multi-language pattern-based security scanner using grep signature databases. Primary use for secrets detection, command injection patterns, and first-pass security scans on unknown codebases. Supports 15+ languages.
Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm). Scans requirements.txt, package.json, package-lock.json for malware, typosquatting, data exfiltration, and compromised maintainers.
Shell script static analysis using ShellCheck. Detects command injection, unquoted variables, reverse shell patterns, dangerous rm operations, obfuscated payloads. Combine with graudit for patterns ShellCheck may miss.
Domain knowledge for extracting headlines from major international news outlets. Covers which tool to use per site, URL patterns, timestamp formats, and filtering rules.
| name | trivy-security-scan |
| description | Comprehensive security scanner for filesystems, container images, and IaC. Detects known CVEs in dependencies, hardcoded secrets, and IaC misconfigurations in Terraform, Kubernetes, Dockerfiles, and CloudFormation. |
| applyTo | ** |
Trivy by Aqua Security is a multi-target, multi-scanner tool that detects CVEs, secrets, misconfigurations, and license issues across containers, filesystems, and cloud-native infrastructure.
# Filesystem vulnerability + secret scan (most common)
trivy fs --scanners vuln,secret ./
# Filter by severity
trivy fs --scanners vuln,secret --severity HIGH,CRITICAL ./
# JSON output for automation
trivy fs --scanners vuln,secret --format json -o results.json ./
# IaC misconfiguration scan
trivy config ./
# Scan specific IaC directory
trivy config --severity HIGH,CRITICAL ./terraform/
# Full scan: vulns + secrets + misconfigs
trivy fs --scanners vuln,secret,misconfig ./
# Skip noisy directories
trivy fs --skip-dirs node_modules,.git,vendor --scanners vuln,secret ./
# Ignore unfixed CVEs
trivy fs --ignore-unfixed --scanners vuln ./
vuln)Detects known CVEs in:
secret)Detects:
misconfig)Checks:
| Finding Type | MITRE ATT&CK |
|---|---|
| CVEs in dependencies | T1195.001 (Supply Chain: Dependencies) |
| CVEs in container images | T1195.002 (Supply Chain: Software) |
| Hardcoded credentials | T1552.001 (Credentials in Files) |
| Private keys | T1552.004 (Private Keys) |
| Dockerfile misconfigs | T1610 (Deploy Container) |
| K8s misconfigs | T1613 (Container Discovery) |
| Severity | CVSS Score | Action |
|---|---|---|
| CRITICAL | 9.0 - 10.0 | Immediate fix required |
| HIGH | 7.0 - 8.9 | Fix before deployment |
| MEDIUM | 4.0 - 6.9 | Plan remediation |
| LOW | 0.1 - 3.9 | Document and monitor |
bandit or graudit for thatguarddog for malicious packages