用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill trivy-vulnerability-scanner命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | trivy-vulnerability-scanner |
| description | 用于通过 Trivy 扫描仓库、容器镜像、文件系统、rootfs、SBOM、Kubernetes、IaC、密钥、许可证和系统 CVE。 |
| zh_description | 用于通过 Trivy 扫描仓库、容器镜像、文件系统、rootfs、SBOM、Kubernetes、IaC、密钥、许可。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, vulnerability-scanning, cve, container-security, kubernetes, sbom, iac, secrets] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | advanced |
Use this skill when the user asks to scan a codebase, container image, Linux root filesystem, Kubernetes cluster, SBOM, or repository for CVEs, misconfigurations, exposed secrets, or license risks with Trivy.
Good trigger phrases:
Classify the target before running commands:
trivy repo or trivy fs.trivy image.trivy rootfs.trivy k8s or trivy config.trivy sbom.Ask only if the target is ambiguous and a wrong scan could be destructive or very slow. Otherwise choose the narrowest safe scan mode.
trivy --version
If missing, recommend the official installation path for the user's OS. Avoid piping remote install scripts into a privileged shell unless the user explicitly approves.
Use a read-only baseline first:
trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --ignore-unfixed .
For a container image:
trivy image --scanners vuln,secret,misconfig --severity HIGH,CRITICAL nginx:latest
For Kubernetes manifests:
trivy config --severity HIGH,CRITICAL ./deploy
For an unpacked Linux root filesystem:
trivy rootfs --severity HIGH,CRITICAL /mnt/rootfs
Use JSON for triage automation:
trivy fs --format json --output trivy-results.json .
Use SARIF for GitHub code scanning:
trivy fs --format sarif --output trivy-results.sarif .
Generate an SBOM when the user needs inventory:
trivy fs --format cyclonedx --output sbom.cdx.json .
trivy image --format spdx-json --output image.spdx.json registry.example.com/app:tag
For each HIGH or CRITICAL finding, capture:
Prioritize in this order:
Common remediation moves:
.trivyignore and an expiration date.name: trivy
on: [pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Build image
run: docker build -t app:${{ github.sha }} .
- name: Scan image
run: |
trivy image \
--exit-code 1 \
--severity HIGH,CRITICAL \
--ignore-unfixed \
app:${{ github.sha }}
- name: Trivy repo scan
run: trivy fs --format sarif --output trivy.sarif .
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: trivy.sarif
# .trivyignore
# CVE accepted until 2026-06-30 because upstream has no fixed Alpine package.
CVE-2026-0000