About

Imported from jeremylongshore/tons-of-skills-marketplace (skills/.curated/scanning-container-security/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-container-security. Copyright stays with the author (MIT).

Scanning Container Security

Name: scanning-container-security
Author: jeremylongshore

Overview

Scan container images and Dockerfiles for vulnerabilities, misconfigurations, and compliance violations using Trivy, Grype, Snyk Container, and Hadolint. Analyze base images, OS packages, application dependencies, and runtime configurations to produce actionable security reports with remediation guidance.

Prerequisites

Container scanning tool installed: trivy, grype, snyk, or docker scout
Dockerfile linter: hadolint for Dockerfile best practice validation
Docker daemon running for local image scanning
Access to the container images to scan (local, registry, or tar archive)
jq for parsing JSON scan results

Instructions

Identify target images for scanning: production images, base images, and CI-built images
Lint Dockerfiles with hadolint Dockerfile to catch misconfigurations before build (privileged instructions, pinned versions, shell best practices)
Scan built images for OS-level vulnerabilities: trivy image <image:tag> or grype <image:tag>
Scan for application dependency vulnerabilities: check language-specific packages (npm, pip, Maven, Go modules) embedded in the image
Check for secrets accidentally baked into image layers: trivy image --scanners secret <image:tag>
Evaluate image against CIS Docker Benchmark: verify non-root user, read-only filesystem capability, health checks defined
Generate a security report with severity classification (Critical, High, Medium, Low) and CVE identifiers
Produce remediation steps: upgrade base image, pin package versions, replace vulnerable dependencies
Integrate scanning into CI/CD pipeline: fail builds on Critical/High vulnerabilities, generate SARIF output for GitHub Security tab

Output

Vulnerability scan report in JSON, table, or SARIF format
Hadolint report with Dockerfile improvement recommendations
Remediation Dockerfile patches (updated base image, pinned package versions)
CI/CD pipeline step configuration for automated image scanning
Security policy document defining acceptable risk thresholds

Error Handling

Error	Cause	Solution
`trivy: unable to pull image`	Image not found locally or registry auth failure	Pull image first with `docker pull` or configure registry credentials
`CRITICAL vulnerability found but no fix available`	Upstream package has no patch yet	Document as accepted risk, use `--ignore-unfixed` flag, or switch to an alternative base image
`hadolint: DL3008 pin versions in apt-get install`	Packages installed without version pinning	Add version pins (e.g., `apt-get install nginx=1.24.0-1`) or use `--no-install-recommends`
`Scan timeout on large image`	Image has many layers or large filesystem	Use `--timeout 15m` flag; scan a specific layer or use `--skip-dirs` to exclude test data
`False positive CVE`	Scanner database maps CVE to a package not actually exploitable	Add to `.trivyignore` or Grype ignore file with justification comment

Examples

"Scan all production Docker images for Critical and High CVEs, generate a report, and create Jira tickets for each finding."
"Lint the Dockerfile for best practices: ensure multi-stage build, non-root USER, no ADD for remote URLs, and pinned base image digest."
"Set up a GitHub Actions step that runs Trivy on every PR, fails on Critical vulnerabilities, and uploads results to the Security tab via SARIF."

Resources

Trivy: https://aquasecurity.github.io/trivy/
Grype: https://github.com/anchore/grype
Hadolint: https://github.com/hadolint/hadolint
Docker Scout: https://docs.docker.com/scout/
CIS Docker Benchmark: https://www.cisecurity.org/benchmark/docker

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/jeremylongshore-tons-of-skills-marketplace-scanning-cont-ef0554/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

jeremylongshore-tons-of-skills-marketplace-scanning-cont-ef0554.ocm.jsonjson

{
  "ocm": "1",
  "id": "jeremylongshore-tons-of-skills-marketplace-scanning-cont-ef0554",
  "kind": "skill",
  "name": "scanning-container-security",
  "description": "Execute use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like \"scan for vulnerabilities\", \"implement security controls\", or \"audit security\".",
  "publisher": "jeremylongshore",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "legal"
    ],
    "tags": [
      "skill-md",
      "devops",
      "security",
      "compliance",
      "audit",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Execute use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like \"scan for vulnerabilities\", \"implement security controls\", or \"audit security\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/jeremylongshore/tons-of-skills-marketplace",
      "path": "skills/.curated/scanning-container-security/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/jeremylongshore/tons-of-skills-marketplace/blob/HEAD/skills/.curated/scanning-container-security/SKILL.md",
      "key": "jeremylongshore/tons-of-skills-marketplace/skills/.curated/scanning-container-security/SKILL.md"
    },
    "compatibility": "Designed for Claude Code",
    "allowed_tools": [
      "Read,",
      "Write,",
      "Edit,",
      "Grep,",
      "Glob,",
      "Bash(docker:*),",
      "Bash(kubectl:*)"
    ],
    "license": "MIT"
  },
  "instructions": "# Scanning Container Security\n\n## Overview\n\nScan container images and Dockerfiles for vulnerabilities, misconfigurations, and compliance violations using Trivy, Grype, Snyk Container, and Hadolint. Analyze base images, OS packages, application dependencies, and runtime configurations to produce actionable security reports with remediation guidance.\n\n## Prerequisites\n\n- Container scanning tool installed: `trivy`, `grype`, `snyk`, or `docker scout`\n- Dockerfile linter: `hadolint` for Dockerfile best practice validation\n- Docker daemon running for local image scanning\n- Access to the container im",
  "cost": {
    "context_tokens": 936
  }
}

Fetch it by URL: GET /api/v1/registry/jeremylongshore-tons-of-skills-marketplace-scanning-cont-ef0554/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.