What it does. Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-aqua-security-for-container-scanning/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-aqua-security-for-container-scanning, or copy the skill folder into ~/.claude/skills/implementing-aqua-security-for-container-scanning/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aqua-security-for-container-scanning/SKILL.md

SKILL.md (verbatim)

name: implementing-aqua-security-for-container-scanning
description: Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations,
  secrets, and license issues in container images across CI/CD pipelines and registries.
domain: cybersecurity
subdomain: devsecops
tags:
- aqua-security
- trivy
- container-scanning
- vulnerability-scanning
- sbom
- image-security
- supply-chain
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- GV.SC-07
- ID.IM-04
- PR.PS-04
mitre_attack:
- T1195
- T1554
- T1059.004
- T1610
- T1611

Implementing Aqua Security for Container Scanning

Overview

Aqua Security provides Trivy, the world's most popular open-source universal security scanner, designed to find vulnerabilities, misconfigurations, secrets, SBOM data, and license issues in containers, Kubernetes, code repositories, and cloud environments. Trivy covers OS packages (Alpine, Debian, Ubuntu, RHEL, etc.) and language-specific dependencies (npm, pip, Maven, Go modules, Cargo, etc.) with vulnerability databases sourced from NVD, vendor advisories, and GitHub Security Advisories. The enterprise Aqua Platform extends Trivy with centralized policy management, runtime protection, and compliance reporting.

When to Use

• When deploying or configuring implementing aqua security for container scanning capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Docker installed for local image scanning
• CI/CD platform (GitHub Actions, GitLab CI, Jenkins, etc.)
• Container registry access (Docker Hub, ECR, GCR, ACR, Harbor)
• Trivy CLI (trivy) or Trivy Operator for Kubernetes
• Aqua Platform license for enterprise features (optional)

Core Scanning Capabilities

Image Vulnerability Scanning

Trivy scans container images layer by layer, identifying CVEs in OS packages and application dependencies. It supports scanning local images, remote registry images, and tar archives.

# Scan a remote image
trivy image python:3.11-slim

# Scan with severity filter
trivy image --severity HIGH,CRITICAL nginx:latest

# Scan and fail CI if critical CVEs found
trivy image --exit-code 1 --severity CRITICAL myapp:latest

# Generate SBOM in CycloneDX format
trivy image --format cyclonedx --output sbom.json myapp:latest

Filesystem and Repository Scanning

# Scan project directory for vulnerabilities in dependencies
trivy fs --scanners vuln,secret,misconfig .

# Scan a specific lockfile
trivy fs --scanners vuln package-lock.json

# Scan git repository
trivy repo https://github.com/org/project

Kubernetes Scanning with Trivy Operator

The Trivy Operator runs inside a Kubernetes cluster and continuously scans workloads:

# Install Trivy Operator via Helm
helm repo add aqua https://aquasecurity.github.io/helm-charts/
helm repo update
helm install trivy-operator aqua/trivy-operator \
  --namespace trivy-system \
  --create-namespace \
  --set trivy.severity="HIGH,CRITICAL" \
  --set operator.scanJobTimeout="5m"

The operator creates VulnerabilityReport and ConfigAuditReport custom resources for each workload.

IaC Misconfiguration Scanning

# Scan Terraform files
trivy config --severity HIGH,CRITICAL ./terraform/

# Scan Dockerfile for misconfigurations
trivy config Dockerfile

# Scan Kubernetes manifests
trivy config ./k8s-manifests/

CI/CD Integration

GitHub Actions

name: Container Security Scan
on:
  push:
    branches: [main]
  pull_request:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

GitLab CI

container_scanning:
  stage: security
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  variables:
    FULL_IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
  script:
    - trivy image --exit-code 0 --format template --template "@/contrib/gitlab.tpl"
      --output gl-container-scanning-report.json $FULL_IMAGE_NAME
    - trivy image --exit-code 1 --severity CRITICAL $FULL_IMAGE_NAME
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json

Jenkins Pipeline

pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                sh 'docker build -t myapp:${BUILD_NUMBER} .'
            }
        }
        stage('Security Scan') {
            steps {
                sh '''
                    trivy image --exit-code 1 \
                      --severity HIGH,CRITICAL \
                      --format json \
                      --output trivy-report.json \
                      myapp:${BUILD_NUMBER}
                '''
            }
            post {
                always {
                    archiveArtifacts artifacts: 'trivy-report.json'
                }
            }
        }
    }
}

Policy Configuration

Trivy Policy with OPA/Rego

Create .trivy/policy.rego for custom policy enforcement:

package trivy

deny[msg] {
    input.Results[_].Vulnerabilities[_].Severity == "CRITICAL"
    msg := "Critical vulnerabilities found in image"
}

deny[msg] {
    input.Results[_].Vulnerabilities[vuln]
    vuln.FixedVersion != ""
    vuln.Severity == "HIGH"
    msg := sprintf("Fixable HIGH vulnerability: %s", [vuln.VulnerabilityID])
}

Ignore File Configuration

Create .trivyignore for accepted risks:

# Accepted risk: vulnerability in test dependency only
CVE-2023-12345

# Accepted until expiry date
CVE-2024-67890 exp:2025-06-01

SBOM Generation and Management

# Generate CycloneDX SBOM
trivy image --format cyclonedx --output sbom-cyclonedx.json myapp:latest

# Generate SPDX SBOM
trivy image --format spdx-json --output sbom-spdx.json myapp:latest

# Scan an existing SBOM for new vulnerabilities
trivy sbom sbom-cyclonedx.json

Monitoring and Reporting

Metric	Description	Target
Images scanned per day	Total images passing through scanning pipeline	All production images
Critical CVE count	Open critical vulnerabilities across all images	0 in production
Mean time to patch	Average days from CVE publication to patched image	< 7 days
SBOM coverage	Percentage of production images with generated SBOMs	100%
Scan duration	Average time per image scan	< 2 minutes

References

• Trivy Documentation
• Trivy GitHub Repository
• Trivy Operator for Kubernetes
• Aqua Security Platform
• CycloneDX SBOM Specification

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Container Scanning Implementation Template

Image Registry Scanning Configuration

Registry	URL	Auth Method	Auto-scan	Schedule
			[ ] Yes

Severity Threshold Policy

Environment	Block Critical	Block High	Block Medium	Block Unfixable
Development	[ ]	[ ]	[ ]	[ ]
Staging	[x]	[ ]	[ ]	[ ]
Production	[x]	[x]	[ ]	[ ]

Accepted Risk Register (.trivyignore)

CVE ID	Package	Reason	Accepted By	Expiry Date

SBOM Tracking

Image	SBOM Format	Storage Location	Last Generated
	[ ] CycloneDX [ ] SPDX

references/api-reference.md (verbatim)

API Reference: Container Image Vulnerability Scanner (Trivy)

Dependencies

Library	Version	Purpose
trivy CLI	>=0.50	Container image scanning (invoked via subprocess)

CLI Usage

python scripts/agent.py \
  --images nginx:latest alpine:3.19 myapp:v1.2 \
  --severity CRITICAL,HIGH \
  --sbom \
  --output-dir /reports/ \
  --output trivy_report.json

Functions

check_trivy_installed() -> bool

Verifies Trivy CLI is available in PATH by running trivy --version.

scan_image(image, severity, ignore_unfixed) -> dict

Runs trivy image --format json --severity CRITICAL,HIGH <image>. Returns parsed JSON output.

scan_image_misconfig(image) -> dict

Runs trivy image --scanners misconfig to detect Dockerfile and config issues.

scan_image_secrets(image) -> dict

Runs trivy image --scanners secret to find embedded secrets in image layers.

generate_sbom(image, output_path) -> bool

Runs trivy image --format cyclonedx to produce CycloneDX SBOM.

parse_vuln_results(scan_data) -> list

Extracts vulnerability details from Trivy JSON: VulnerabilityID, PkgName, InstalledVersion, FixedVersion, Severity.

compute_summary(vulns) -> dict

Counts vulnerabilities by severity level (CRITICAL/HIGH/MEDIUM/LOW) and fixable count.

scan_multiple_images(images, severity) -> dict

Orchestrates scanning of multiple images and aggregates results.

Trivy CLI Commands Used

Command	Purpose
trivy image --format json	Vulnerability scan with JSON output
trivy image --scanners misconfig	Misconfiguration detection
trivy image --scanners secret	Secret detection in layers
trivy image --format cyclonedx	SBOM generation

Output Schema

{
  "images": [{"image": "nginx:latest", "summary": {"CRITICAL": 2, "HIGH": 5, "fixable": 4}}],
  "overall_summary": {"CRITICAL": 2, "HIGH": 5, "total": 7}
}

references/standards.md (verbatim)

Standards Reference for Container Scanning

NIST SP 800-190: Application Container Security Guide

Recommendation	Trivy Coverage
4.1 Image vulnerabilities	CVE scanning of OS packages and app dependencies
4.2 Image configuration defects	IaC misconfig scanning of Dockerfiles
4.3 Embedded malware	Secret scanning detects embedded credentials
4.4 Embedded cleartext secrets	Secret scanner with regex and entropy detection
4.5 Use of untrusted images	Registry scanning and image provenance verification

CIS Docker Benchmark v1.6 Alignment

CIS Control	Trivy Check
4.1 Ensure image is created from a trusted base	Base image vulnerability scanning
4.3 Ensure unnecessary packages are not installed	SBOM generation reveals full package inventory
4.6 Add HEALTHCHECK instruction	Dockerfile misconfiguration check
4.9 Ensure COPY instead of ADD	Dockerfile misconfiguration check
4.10 Ensure secrets are not stored in Dockerfiles	Secret detection in filesystem scan

Vulnerability Database Sources

Source	Coverage	Update Frequency
NVD (NIST)	All CVEs	Continuous
Alpine SecDB	Alpine Linux packages	Daily
Debian Security Tracker	Debian packages	Daily
Ubuntu CVE Tracker	Ubuntu packages	Daily
Red Hat OVAL	RHEL/CentOS packages	Daily
GitHub Advisory Database	Language packages	Continuous
Go Vulnerability Database	Go modules	Continuous
RustSec Advisory Database	Rust crates	Continuous

references/workflows.md (verbatim)

Aqua Security Container Scanning Workflows

Workflow 1: CI/CD Image Gate

Developer commits code
       |
Docker image built in CI
       |
Trivy scans image for vulnerabilities
       |
[No Critical/High] --> Image pushed to registry
[Critical found] --> Pipeline fails, image rejected
       |
SBOM generated and stored alongside image
       |
Image tagged with scan metadata
       |
Kubernetes admission controller validates scan results
       |
Deployment proceeds only with scanned images

Workflow 2: Registry Continuous Scanning

New image pushed to container registry
       |
Trivy Operator detects new image tag
       |
Scheduled scan triggered
       |
VulnerabilityReport CR created in cluster
       |
New CVE published in NVD
       |
Re-scan of all running images
       |
Alert generated for newly affected images
       |
Remediation ticket created automatically

Workflow 3: SBOM-Based Vulnerability Tracking

Image scanned, SBOM generated (CycloneDX/SPDX)
       |
SBOM stored in artifact repository
       |
New CVE published
       |
SBOM re-scanned without rebuilding image
       |
Affected images identified across fleet
       |
Prioritized patching based on exposure and severity

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.