Skip to main content 首页 创作者 rohunj claude-build-workflow sca-trivy
sca-trivy Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license compliance risks. Use when: (1) Scanning container images and filesystems for vulnerabilities and misconfigurations, (2) Analyzing dependencies for known CVEs across multiple languages (Go, Python, Node.js, Java, etc.), (3) Detecting IaC security issues in Terraform, Kubernetes, Dockerfile, (4) Integrating vulnerability scanning into CI/CD pipelines with SARIF output, (5) Generating Software Bill of Materials (SBOM) in CycloneDX or SPDX format, (6) Prioritizing remediation by CVSS score and exploitability.
跳到安装 Skills Marketplace 发现并探索由社区构建的 Agent Skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/rohunj/claude-build-workflow --skill sca-trivy命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
下载 Zip 下载中... 同仓库更多 Skills Convert bug reports into prd.json user stories for autonomous fixing. Use after running test-and-break skill. Triggers on: convert bugs to stories, fix these bugs, add bugs to prd, create fix stories.
vercel-react-best-practices React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models programmatically using Python code, (2) Generating data flow diagrams (DFDs) with automatic STRIDE threat identification, (3) Integrating threat modeling into CI/CD pipelines and shift-left security practices, (4) Analyzing system architecture for security threats across trust boundaries, (5) Producing threat reports with STRIDE categories and mitigation recommendations, (6) Maintaining threat models as code for version control and automation.
name sca-trivy description Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license compliance risks. Use when: (1) Scanning container images and filesystems for vulnerabilities and misconfigurations, (2) Analyzing dependencies for known CVEs across multiple languages (Go, Python, Node.js, Java, etc.), (3) Detecting IaC security issues in Terraform, Kubernetes, Dockerfile, (4) Integrating vulnerability scanning into CI/CD pipelines with SARIF output, (5) Generating Software Bill of Materials (SBOM) in CycloneDX or SPDX format, (6) Prioritizing remediation by CVSS score and exploitability.
version 0.1.0 maintainer SirAppSec category devsecops tags ["sca","trivy","container-security","vulnerability-scanning","sbom","iac-security","dependency-scanning","cvss"] frameworks ["OWASP","CWE","NIST","PCI-DSS","SOC2"] dependencies {"tools":["trivy","docker"]} references ["https://aquasecurity.github.io/trivy/","https://owasp.org/www-project-dependency-check/","https://nvd.nist.gov/","https://www.cisa.gov/sbom"]
Software Composition Analysis with Trivy
Overview
Trivy is a comprehensive security scanner for containers, filesystems, and git repositories. It detects
vulnerabilities (CVEs) in OS packages and application dependencies, IaC misconfigurations, exposed secrets,
and software licenses. This skill provides workflows for vulnerability scanning, SBOM generation, CI/CD
integration, and remediation prioritization aligned with CVSS and OWASP standards.
Quick Start
Scan a container image for vulnerabilities:
brew install trivy
trivy image nginx:latest
trivy fs .
trivy config .
trivy image --format cyclonedx --output sbom.json nginx:latest
Core Workflows
Workflow 1: Container Image Security Assessment
Progress:
[ ] 1. Identify target container image (repository:tag)
[ ] 2. Run comprehensive Trivy scan with trivy image <image-name>
[ ] 3. Analyze vulnerability findings by severity (CRITICAL, HIGH, MEDIUM, LOW)
[ ] 4. Map CVE findings to CWE categories and OWASP references
[ ] 5. Check for available patches and updated base images
[ ] 6. Generate prioritized remediation report with upgrade recommendations
Work through each step systematically. Check off completed items.
Workflow 2: Dependency Vulnerability Scanning
Scan project dependencies for known vulnerabilities:
trivy fs --severity CRITICAL,HIGH .
trivy fs --scanners vuln package-lock.json
trivy fs --format json --output trivy-report.json .
trivy fs --format sarif --output trivy.sarif .
For each vulnerability:
Review CVE details and CVSS score
Check if fixed version is available
Consult references/remediation_guide.md for language-specific guidance
Update dependency to patched version
Re-scan to validate fix
Workflow 3: Infrastructure as Code Security Detect misconfigurations in IaC files:
trivy config ./terraform --severity CRITICAL,HIGH
trivy config ./k8s --severity CRITICAL,HIGH
trivy config --file-patterns dockerfile:Dockerfile .
trivy config --format json --output iac-findings.json .
Review findings by category:
Security : Authentication, authorization, encryptionCompliance : CIS benchmarks, security standardsBest Practices : Resource limits, immutability, least privilege
Workflow 4: CI/CD Pipeline Integration
GitHub Actions name: Trivy Security Scan
on: [push , pull_request ]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
scan-ref: '.'
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH'
- name: Upload results to GitHub Security
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
GitLab CI trivy-scan:
stage: test
image: aquasec/trivy:latest
script:
- trivy fs --exit-code 1 --severity CRITICAL,HIGH --format json --output trivy-report.json .
artifacts:
reports:
dependency_scanning: trivy-report.json
when: always
allow_failure: false
Use bundled templates from assets/ci_integration/ for additional platforms.
Workflow 5: SBOM Generation Generate Software Bill of Materials for supply chain transparency:
trivy image --format cyclonedx --output sbom-cyclonedx.json nginx:latest
trivy image --format spdx-json --output sbom-spdx.json nginx:latest
trivy fs --format cyclonedx --output project-sbom.json .
Vulnerability tracking : Monitor dependencies for new CVEsLicense compliance : Identify license obligations and risksSupply chain security : Verify component provenanceRegulatory compliance : Meet CISA SBOM requirements
Security Considerations
Sensitive Data Handling
Registry credentials : Use environment variables or credential helpers, never hardcodeScan reports : Contain vulnerability details and package versions - treat as sensitiveSBOM files : May reveal internal architecture - control access appropriatelySecret scanning : Enable with --scanners secret to detect exposed credentials in images
Access Control
Container registry access : Requires pull permissions for image scanningFilesystem access : Read permissions for dependency manifests and IaC filesCI/CD integration : Secure API tokens and registry credentials in secrets managementReport storage : Restrict access to vulnerability reports and SBOM artifacts
Audit Logging Log the following for compliance and incident response:
Scan execution timestamps and scope (image, filesystem, repository)
Vulnerability counts by severity level
Policy violations and blocking decisions
SBOM generation and distribution events
Remediation actions and version updates
Compliance Requirements
PCI-DSS 6.2 : Ensure system components protected from known vulnerabilitiesSOC2 CC7.1 : Detect and act upon changes that could affect securityNIST 800-53 SI-2 : Flaw remediation and vulnerability scanningCIS Benchmarks : Container and Kubernetes security hardeningOWASP Top 10 A06 : Vulnerable and Outdated ComponentsCWE-1104 : Use of Unmaintained Third-Party Components
Bundled Resources
Scripts (scripts/)
trivy_scan.py - Comprehensive scanning with JSON/SARIF output and severity filteringsbom_generator.py - SBOM generation with CycloneDX and SPDX format supportvulnerability_report.py - Parse Trivy output and generate remediation reports with CVSS scoresbaseline_manager.py - Baseline creation for tracking new vulnerabilities only
References (references/)
scanner_types.md - Detailed guide for vulnerability, misconfiguration, secret, and license scanningremediation_guide.md - Language and ecosystem-specific remediation strategiescvss_prioritization.md - CVSS score interpretation and vulnerability prioritization frameworkiac_checks.md - Complete list of IaC security checks with CIS benchmark mappings
Assets (assets/)
trivy.yaml - Custom Trivy configuration with security policies and ignore rulesci_integration/github-actions.yml - Complete GitHub Actions workflow with security gatesci_integration/gitlab-ci.yml - Complete GitLab CI pipeline with dependency scanningci_integration/jenkins.groovy - Jenkins pipeline with Trivy integrationpolicy_template.rego - OPA policy template for custom vulnerability policies
Common Patterns
Pattern 1: Multi-Stage Security Scanning Comprehensive security assessment combining multiple scan types:
trivy image --severity CRITICAL,HIGH myapp:latest
trivy config ./infrastructure --severity CRITICAL,HIGH
trivy fs --severity CRITICAL,HIGH ./app
trivy fs --scanners secret ./app
trivy image --format cyclonedx --output sbom.json myapp:latest
Pattern 2: Baseline Vulnerability Tracking Implement baseline scanning to track only new vulnerabilities:
trivy image --format json --output baseline.json nginx:latest
trivy image --format json --output current.json nginx:latest
./scripts/baseline_manager.py --baseline baseline.json --current current.json
Pattern 3: License Compliance Scanning Detect license compliance risks:
trivy image --scanners license --format json --output licenses.json myapp:latest
trivy image --scanners license --severity HIGH,CRITICAL myapp:latest
High Risk : GPL, AGPL (strong copyleft)Medium Risk : LGPL, MPL (weak copyleft)Low Risk : Apache, MIT, BSD (permissive)
Pattern 4: Custom Policy Enforcement Apply custom security policies with OPA:
trivy image --format json --output scan.json myapp:latest
trivy image --ignore-policy assets/policy_template.rego myapp:latest
Integration Points
CI/CD Integration
GitHub Actions : Native aquasecurity/trivy-action with SARIF upload to Security tabGitLab CI : Dependency scanning report format for Security DashboardJenkins : Docker-based scanning with JUnit XML report generationCircleCI : Docker executor with artifact storageAzure Pipelines : Task-based integration with results publishing
Container Platforms
Docker : Image scanning before push to registryKubernetes : Admission controllers with trivy-operator for runtime scanningHarbor : Built-in Trivy integration for registry scanningAWS ECR : Scan images on push with enhanced scanningGoogle Artifact Registry : Vulnerability scanning integration
Security Tools Ecosystem
SIEM Integration : Export JSON findings to Splunk, ELK, or DatadogVulnerability Management : Import SARIF/JSON into Snyk, Qualys, or Rapid7SBOM Tools : CycloneDX and SPDX compatibility with dependency-track and GUACPolicy Enforcement : OPA/Rego integration for custom policy as code
Troubleshooting
Issue: High False Positive Rate Symptoms : Many vulnerabilities reported that don't apply to your use case
Use .trivyignore file to suppress specific CVEs with justification
Filter by exploitability: trivy image --ignore-unfixed myapp:latest
Apply severity filtering: --severity CRITICAL,HIGH
Review vendor-specific security advisories for false positive validation
See references/false_positives.md for common patterns
Issue: Performance Issues on Large Images Symptoms : Scans taking excessive time or high memory usage
Use cached DB: trivy image --cache-dir /path/to/cache myapp:latest
Skip unnecessary scanners: --scanners vuln (exclude config, secret)
Use offline mode after initial DB download: --offline-scan
Increase timeout: --timeout 30m
Scan specific layers: --removed-pkgs to exclude removed packages
Issue: Missing Vulnerabilities for Specific Languages Symptoms : Expected CVEs not detected in application dependencies
Verify language support: Check supported languages and file patterns
Ensure dependency manifests are present (package.json, go.mod, requirements.txt)
Include lock files for accurate version detection
For compiled binaries, scan source code separately
Consult references/scanner_types.md for language-specific requirements
Issue: Registry Authentication Failures Symptoms : Unable to scan private container images
docker login registry.example.com
trivy image registry.example.com/private/image:tag
export TRIVY_USERNAME=user
export TRIVY_PASSWORD=pass
trivy image registry.example.com/private/image:tag
trivy image --username user --password pass registry.example.com/private/image:tag
Advanced Configuration
Custom Trivy Configuration Create trivy.yaml configuration file:
vulnerability:
type: os,library
severity: CRITICAL,HIGH,MEDIUM
ignorefile: .trivyignore
ignore-unfixed: false
skip-files:
- "test/**"
- "**/node_modules/**"
cache:
dir: /tmp/trivy-cache
db:
repository: ghcr.io/aquasecurity/trivy-db:latest
output:
format: json
severity-sort: true
Use with: trivy image --config trivy.yaml myapp:latest
Trivy Ignore File Create .trivyignore to suppress specific CVEs:
# .trivyignore
# False positive - patched in vendor fork
CVE-0000-12345
# Risk accepted by security team - JIRA-1234
CVE-0000-67890
# No fix available, compensating controls in place
CVE-0000-11111
Offline Air-Gapped Scanning For air-gapped environments:
trivy image --download-db-only --cache-dir /path/to/db
trivy image --skip-db-update --cache-dir /path/to/db --offline-scan myapp:latest
References 