trivy

Getting Started

1. Install the skill using the command above
2. Open your AI coding agent (Claude Code, Codex, Gemini CLI, or Cursor)
3. Reference the skill in your prompt
4. The AI will use the skill's capabilities automatically

Example Prompts

• "Deploy the latest build to the staging environment and run smoke tests"
• "Check the CI pipeline status and summarize any recent failures"

Overview

Trivy is an open-source vulnerability scanner by Aqua Security. Scans container images, filesystems, git repos, and IaC for vulnerabilities, misconfigurations, and exposed secrets.

Instructions

Step 1: Install

brew install trivy

Step 2: Container Scanning

trivy image node:20-alpine
trivy image --severity CRITICAL,HIGH my-app:latest
trivy image --format json --output results.json my-app:latest

Step 3: Filesystem and Secret Scan

trivy fs .
trivy fs --scanners vuln,secret,misconfig .

Step 4: IaC Scanning

trivy config ./terraform/
trivy config ./k8s/

Guidelines

• Free and open-source — no account needed.
• Local vulnerability DB, updated automatically — scans are fast.
• Supports SBOM generation (CycloneDX, SPDX) for compliance.
• Use in CI to block deployments with critical CVEs.