About

Imported from terminalskills/skills (skills/trivy/SKILL.md). Install upstream with npx skills add terminalskills/skills --skill trivy. Copyright stays with the author (Apache-2.0).

Trivy

Name: trivy
Author: terminalskills

Overview

Trivy is an open-source vulnerability scanner by Aqua Security. Scans container images, filesystems, git repos, and IaC for vulnerabilities, misconfigurations, and exposed secrets.

Instructions

Step 1: Install

brew install trivy

Step 2: Container Scanning

trivy image node:20-alpine
trivy image --severity CRITICAL,HIGH my-app:latest
trivy image --format json --output results.json my-app:latest

Step 3: Filesystem and Secret Scan

trivy fs .
trivy fs --scanners vuln,secret,misconfig .

Step 4: IaC Scanning

trivy config ./terraform/
trivy config ./k8s/

Guidelines

Free and open-source — no account needed.
Local vulnerability DB, updated automatically — scans are fast.
Supports SBOM generation (CycloneDX, SPDX) for compliance.
Use in CI to block deployments with critical CVEs.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/terminalskills-skills-trivy/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

terminalskills-skills-trivy.ocm.jsonjson

{
  "ocm": "1",
  "id": "terminalskills-skills-trivy",
  "kind": "skill",
  "name": "trivy",
  "description": "Scan containers, filesystems, and repos for vulnerabilities with Trivy. Use when a user asks to scan Docker images for CVEs, audit filesystem for secrets, check IaC for misconfigurations, or add security scanning to CI.",
  "publisher": "terminalskills",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "trivy",
      "vulnerability",
      "container",
      "scanning",
      "ci-cd",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Scan containers, filesystems, and repos for vulnerabilities with Trivy. Use when a user asks to scan Docker images for CVEs, audit filesystem for secrets, check IaC for misconfigurations, or add security scanning to CI."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/terminalskills/skills",
      "path": "skills/trivy/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/terminalskills/skills/blob/HEAD/skills/trivy/SKILL.md",
      "key": "terminalskills/skills/skills/trivy/SKILL.md"
    },
    "compatibility": "Docker, Linux, macOS",
    "license": "Apache-2.0"
  },
  "instructions": "# Trivy\n\n## Overview\n\nTrivy is an open-source vulnerability scanner by Aqua Security. Scans container images, filesystems, git repos, and IaC for vulnerabilities, misconfigurations, and exposed secrets.\n\n## Instructions\n\n### Step 1: Install\n\n```bash\nbrew install trivy\n```\n\n### Step 2: Container Scanning\n\n```bash\ntrivy image node:20-alpine\ntrivy image --severity CRITICAL,HIGH my-app:latest\ntrivy image --format json --output results.json my-app:latest\n```\n\n### Step 3: Filesystem and Secret Scan\n\n```bash\ntrivy fs .\ntrivy fs --scanners vuln,secret,misconfig .\n```\n\n### Step 4: IaC Scanning\n\n```bash",
  "cost": {
    "context_tokens": 222
  }
}

Fetch it by URL: GET /api/v1/registry/terminalskills-skills-trivy/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.