scanning-docker-images-with-trivy skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki
Contents
  1. Install
  2. SKILL.md (verbatim)
  3. Overview
  4. When to Use
  5. Prerequisites
  6. Core Concepts
  7. Scanner Types
  8. Severity Levels
  9. Vulnerability Database
  10. Workflow
  11. Step 1: Install Trivy
  12. Step 2: Basic Image Scanning
  13. Step 3: Advanced Scanning Options
  14. Step 4: Scanning Kubernetes Manifests
  15. Step 5: CI/CD Integration
  16. Step 6: Policy Enforcement with .trivyignore
  17. Step 7: Scan Private Registry Images
  18. Validation Commands
  19. References
  20. Other files in this skill
  21. assets/template.md (verbatim)
  22. Scan Information
  23. Vulnerability Summary
  24. Critical Findings
  25. High Findings
  26. Secrets Detected
  27. Misconfigurations
  28. SBOM Summary
  29. Policy Decision
  30. Risk Acceptance (if applicable)
  31. Remediation Actions
  32. references/api-reference.md (verbatim)
  33. Trivy Scanner Types
  34. Core Commands
  35. Vulnerability Database Sources
  36. Python Libraries
  37. References
  38. references/standards.md (verbatim)
  39. NIST SP 800-190 - Application Container Security Guide
  40. Relevant Controls
  41. CIS Docker Benchmark v1.8.0
  42. Section 4: Container Images and Build File
  43. NIST SSDF (Secure Software Development Framework)
  44. PW.4 - Reuse Existing, Well-Secured Software
  45. RV.1 - Identify and Confirm Vulnerabilities
  46. OWASP Container Security Verification Standard
  47. V2: Image Security
  48. Executive Order 14028 - Improving the Nation's Cybersecurity
  49. SBOM Requirements
  50. Trivy Vulnerability Scoring
  51. CVSS v3.1 Severity Mapping
  52. Vulnerability Data Sources
  53. references/workflows.md (verbatim)
  54. Workflow 1: Developer Local Scan
  55. Workflow 2: CI/CD Gate Scan
  56. Workflow 3: Registry Continuous Scanning
  57. Workflow 4: Full SBOM + Vulnerability Pipeline
  58. Workflow 5: Multi-Image Fleet Scanning
  59. Workflow 6: Trivy Operator for Kubernetes

What it does. Scans a Docker image with Trivy for vulnerabilities in OS packages and language dependencies, misconfiguration, exposed secrets, and licence violations, emitting SARIF, CycloneDX, or SPDX output. Use when scanning or gating a specific image, wiring an image scan into CI/CD, or checking an image during an incident investigation. Keywords: Trivy, image scan, --severity, --exit-code, SARIF, ignore file, .trivyignore. Do not use for cluster-wide scanning or non-image targets - use performing-container-security-scanning-with-trivy; when the toolchain is Grype use scanning-container-images-with-grype. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/scanning-docker-images-with-trivy/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill scanning-docker-images-with-trivy, or copy the skill folder into ~/.claude/skills/scanning-docker-images-with-trivy/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-docker-images-with-trivy/SKILL.md

SKILL.md (verbatim)

name: scanning-docker-images-with-trivy
description: >-
  Scans a Docker image with Trivy for vulnerabilities in OS packages and language
  dependencies, misconfiguration, exposed secrets, and licence violations, emitting SARIF,
  CycloneDX, or SPDX output. Use when scanning or gating a specific image, wiring an image
  scan into CI/CD, or checking an image during an incident investigation. Keywords: Trivy,
  image scan, --severity, --exit-code, SARIF, ignore file, .trivyignore. Do not use for
  cluster-wide scanning or non-image targets - use
  performing-container-security-scanning-with-trivy; when the toolchain is Grype use
  scanning-container-images-with-grype.
domain: cybersecurity
subdomain: container-security
tags:
- containers
- docker
- security
- trivy
- vulnerability-scanning
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.IR-01
- ID.AM-08
- DE.CM-01
mitre_attack:
- T1610
- T1611
- T1609
- T1525
- T1190

Scanning Docker Images with Trivy

Overview

Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violations within container images. It integrates into CI/CD pipelines and supports multiple output formats including SARIF, CycloneDX, and SPDX.

When to Use

  • When conducting security assessments that involve scanning docker images with trivy
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Docker Engine 20.10+
  • Trivy v0.50+ installed
  • Internet access for vulnerability database updates
  • Container registry credentials (for private registries)

Core Concepts

Scanner Types

Scanner Flag Detects
Vulnerability --scanners vuln CVEs in OS packages and libraries
Misconfiguration --scanners misconfig Dockerfile/K8s manifest misconfigs
Secret --scanners secret Hardcoded passwords, API keys, tokens
License --scanners license Software license compliance issues

Severity Levels

  • CRITICAL: CVSS 9.0-10.0 - Immediate action required
  • HIGH: CVSS 7.0-8.9 - Fix before production deployment
  • MEDIUM: CVSS 4.0-6.9 - Plan remediation
  • LOW: CVSS 0.1-3.9 - Accept or fix opportunistically
  • UNKNOWN: Unscored - Evaluate manually

Vulnerability Database

Trivy uses multiple vulnerability databases:

  • NVD (National Vulnerability Database)
  • Red Hat Security Data
  • Alpine SecDB
  • Debian Security Tracker
  • Ubuntu CVE Tracker
  • Amazon Linux Security Center
  • GitHub Advisory Database

Workflow

Step 1: Install Trivy

# Linux (apt)
sudo apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update && sudo apt-get install trivy

# macOS
brew install trivy

# Docker
docker pull aquasecurity/trivy:latest

Step 2: Basic Image Scanning

# Scan a public image
trivy image python:3.12-slim

# Scan with severity filter
trivy image --severity CRITICAL,HIGH nginx:latest

# Ignore unfixed vulnerabilities
trivy image --ignore-unfixed alpine:3.19

# Scan local image
docker build -t myapp:latest .
trivy image myapp:latest

# Scan from tar archive
docker save myapp:latest -o myapp.tar
trivy image --input myapp.tar

Step 3: Advanced Scanning Options

# All scanners (vuln + misconfig + secret + license)
trivy image --scanners vuln,misconfig,secret,license myapp:latest

# Generate SBOM in CycloneDX format
trivy image --format cyclonedx --output sbom.cdx.json myapp:latest

# Generate SBOM in SPDX format
trivy image --format spdx-json --output sbom.spdx.json myapp:latest

# JSON output for programmatic processing
trivy image --format json --output results.json myapp:latest

# SARIF output for GitHub Security tab
trivy image --format sarif --output results.sarif myapp:latest

# Template-based output
trivy image --format template --template "@contrib/html.tpl" --output report.html myapp:latest

# Scan specific layers only
trivy image --list-all-pkgs myapp:latest

Step 4: Scanning Kubernetes Manifests

# Scan Dockerfile for misconfigurations
trivy config Dockerfile

# Scan Kubernetes manifests
trivy config k8s-deployment.yaml

# Scan Helm charts
trivy config ./helm-chart/

# Scan Terraform files
trivy config ./terraform/

Step 5: CI/CD Integration

# GitHub Actions
name: Trivy Container Scan
on: push

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: 1

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

      - name: Generate SBOM
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: cyclonedx
          output: sbom.cdx.json

# GitLab CI
trivy-scan:
  stage: security
  image:
    name: aquasecurity/trivy:latest
    entrypoint: [""]
  script:
    - trivy image --exit-code 1 --severity CRITICAL,HIGH
        --format json --output gl-container-scanning-report.json
        $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json

Step 6: Policy Enforcement with .trivyignore

# .trivyignore - Ignore specific CVEs with expiry
# Accepted risk: low-impact vulnerability in dev dependency
CVE-2023-12345 exp:2025-06-01

# False positive: not exploitable in our configuration
CVE-2024-67890

# Vendor will not fix
CVE-2023-11111

Step 7: Scan Private Registry Images

# Docker Hub (uses ~/.docker/config.json)
trivy image myregistry.azurecr.io/myapp:latest

# ECR
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin <account>.dkr.ecr.us-east-1.amazonaws.com
trivy image <account>.dkr.ecr.us-east-1.amazonaws.com/myapp:latest

# GCR
trivy image gcr.io/my-project/myapp:latest

# With explicit credentials
TRIVY_USERNAME=user TRIVY_PASSWORD=pass trivy image registry.example.com/myapp:latest

Validation Commands

# Verify Trivy installation
trivy version

# Update vulnerability database
trivy image --download-db-only

# Quick scan with table output
trivy image --severity CRITICAL python:3.12

# Verify no CRITICAL vulnerabilities
trivy image --exit-code 1 --severity CRITICAL myapp:latest
echo "Exit code: $?"  # 0 = no vulns, 1 = vulns found

References

Other files in this skill

assets/template.md (verbatim)

Trivy Image Scan Report Template

Scan Information

Field Value
Image
Tag/Digest
Scan Date
Trivy Version
DB Version
Scanners Used vuln / misconfig / secret / license

Vulnerability Summary

Severity Count Threshold Status
CRITICAL 0 PASS/FAIL
HIGH 5 PASS/FAIL
MEDIUM 20 PASS/FAIL
LOW N/A INFO
UNKNOWN N/A INFO

Critical Findings

CVE ID Package Installed Fixed CVSS Description

High Findings

CVE ID Package Installed Fixed CVSS Description

Secrets Detected

Rule ID Category Severity File Match (redacted)

Misconfigurations

ID Type Severity Title Resolution

SBOM Summary

Package Type Count
OS packages
Python packages
Node.js packages
Go modules
Java libraries

Policy Decision

  • APPROVED for deployment
  • BLOCKED - requires remediation
  • EXCEPTION GRANTED (see risk acceptance below)

Risk Acceptance (if applicable)

CVE ID Justification Expiry Date Approved By

Remediation Actions

Priority CVE/Finding Action Owner ETA
P1
P2

references/api-reference.md (verbatim)

API Reference: Scanning Docker Images with Trivy

Trivy Scanner Types

Scanner Flag Detects
Vulnerability --scanners vuln CVEs in OS packages and libraries
Misconfiguration --scanners misconfig Dockerfile/K8s misconfigs
Secret --scanners secret Hardcoded passwords, API keys
License --scanners license License compliance issues

Core Commands

Command Description
trivy image <ref> Scan Docker image
trivy image --input <tar> Scan saved tar archive
trivy image --format json JSON output
trivy image --format sarif SARIF for GitHub Security
trivy image --format cyclonedx CycloneDX SBOM
trivy image --format spdx-json SPDX SBOM
trivy image --exit-code 1 --severity CRITICAL Fail on critical
trivy image --list-all-pkgs List all detected packages

Vulnerability Database Sources

Source Coverage
NVD All ecosystems
GitHub Advisory Database Open source packages
Alpine SecDB Alpine Linux
Debian Security Tracker Debian packages
Red Hat Security Data RHEL/CentOS
Ubuntu CVE Tracker Ubuntu packages

Python Libraries

Library Version Purpose
subprocess stdlib Execute trivy CLI
json stdlib Parse scan results
pathlib stdlib File path handling

References

references/standards.md (verbatim)

Standards Reference - Docker Image Scanning with Trivy

NIST SP 800-190 - Application Container Security Guide

Relevant Controls

  • Image Vulnerability Management: Organizations should maintain a pipeline for scanning and remediating container image vulnerabilities
  • Image Provenance: Use content trust and signing to verify image source and integrity
  • SBOM Generation: Produce Software Bill of Materials for all container images

CIS Docker Benchmark v1.8.0

Section 4: Container Images and Build File

  • 4.4: Ensure images are scanned and rebuilt to include security patches
  • 4.5: Ensure Content trust for Docker is Enabled
  • 4.8: Ensure setuid and setgid permissions are removed

NIST SSDF (Secure Software Development Framework)

PW.4 - Reuse Existing, Well-Secured Software

  • PW.4.1: Verify third-party software components have no known vulnerabilities
  • PW.4.4: Verify software components are obtained from trusted sources

RV.1 - Identify and Confirm Vulnerabilities

  • RV.1.1: Gather information from vulnerability notifications
  • RV.1.2: Review, analyze, and/or test code to identify vulnerabilities

OWASP Container Security Verification Standard

V2: Image Security

  • 2.1: Verify images are scanned for known vulnerabilities before deployment
  • 2.2: Verify base images are from trusted sources
  • 2.3: Verify images do not contain embedded secrets
  • 2.4: Verify unnecessary packages are removed from images
  • 2.5: Verify images use minimal base (distroless/Alpine)

Executive Order 14028 - Improving the Nation's Cybersecurity

SBOM Requirements

  • Software producers must provide SBOMs for federal software
  • SBOMs must follow NTIA minimum elements
  • Supported formats: SPDX, CycloneDX
  • Trivy supports both SPDX and CycloneDX SBOM generation

Trivy Vulnerability Scoring

CVSS v3.1 Severity Mapping

Score Range Severity Trivy Flag
9.0 - 10.0 CRITICAL --severity CRITICAL
7.0 - 8.9 HIGH --severity HIGH
4.0 - 6.9 MEDIUM --severity MEDIUM
0.1 - 3.9 LOW --severity LOW
N/A UNKNOWN --severity UNKNOWN

Vulnerability Data Sources

Source Coverage
NVD All CVEs
GHSA GitHub ecosystem packages
Red Hat OVAL RHEL, CentOS
Debian Security Tracker Debian
Ubuntu CVE Tracker Ubuntu
Alpine SecDB Alpine Linux
Amazon ALAS Amazon Linux
SUSE OVAL SUSE/openSUSE
Wolfi SecDB Wolfi/Chainguard

references/workflows.md (verbatim)

1 placeholder credential shortened to pass the site's secret filter.

Workflows - Docker Image Scanning with Trivy

Workflow 1: Developer Local Scan

[Developer builds image] --> [trivy image myapp:latest]
         |                            |
         v                            v
    Fix Dockerfile              Review findings
    Update deps                      |
         |                    +------+------+
         |                    |             |
         v                    v             v
    Rebuild image       CRITICAL/HIGH    MEDIUM/LOW
         |               found?           found?
         |                 |               |
         v                 v               v
    Re-scan          Fix immediately   Add to backlog
                     before commit     or .trivyignore

Workflow 2: CI/CD Gate Scan

# Pipeline stages
Build --> Scan --> Gate Decision --> Deploy/Block

# Gate policy
CRITICAL: Block deployment, fail pipeline (exit-code 1)
HIGH: Block deployment to production
MEDIUM: Warn, allow deployment to staging
LOW: Informational only

Workflow 3: Registry Continuous Scanning

[Images in Registry]
        |
        v
[Scheduled Trivy Scan (daily/weekly)]
        |
        +--> [New CVE detected in existing image]
        |            |
        |            v
        |     [Create JIRA/GitHub issue]
        |            |
        |            v
        |     [Rebuild and push patched image]
        |
        +--> [No new CVEs]
                     |
                     v
              [Log clean scan result]

Workflow 4: Full SBOM + Vulnerability Pipeline

#!/bin/bash
IMAGE="myapp:v1.0.0"

# Step 1: Generate SBOM
trivy image --format cyclonedx --output sbom.cdx.json "$IMAGE"

# Step 2: Vulnerability scan
trivy image --format json --output vuln-report.json "$IMAGE"

# Step 3: License scan
trivy image --scanners license --format json --output license-report.json "$IMAGE"

# Step 4: Secret scan
trivy image --scanners secret --format json --output secret-report.json "$IMAGE"

# Step 5: Config scan (if Dockerfile available)
trivy config --format json --output config-report.json Dockerfile

# Step 6: Generate HTML report
trivy image --format template \
  --template "@contrib/html.tpl" \
  --output report.html "$IMAGE"

# Step 7: Upload to dependency tracking (e.g., Dependency-Track)
curl -X POST "https://dtrack.example.com/api/v1/bom" \
  -H "X-Api-Key: YOUR_KEY \
  -F "project=$PROJECT_UUID" \
  -F "bom=@sbom.cdx.json"

Workflow 5: Multi-Image Fleet Scanning

#!/bin/bash
# Scan all images in a Kubernetes cluster

# Get unique images
IMAGES=$(kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{range .spec.containers[*]}{.image}{"\n"}{end}{end}' | sort -u)

echo "Scanning $(echo "$IMAGES" | wc -l) unique images..."

for IMAGE in $IMAGES; do
  echo "=== Scanning: $IMAGE ==="
  trivy image --severity CRITICAL,HIGH --exit-code 0 \
    --format json --output "scan_$(echo $IMAGE | tr '/:' '_').json" \
    "$IMAGE" 2>/dev/null
done

# Aggregate results
echo "Generating aggregate report..."
python3 aggregate_trivy_results.py scan_*.json > fleet_report.json

Workflow 6: Trivy Operator for Kubernetes

# Install Trivy Operator via Helm
# helm install trivy-operator aquasecurity/trivy-operator \
#   --namespace trivy-system --create-namespace

# VulnerabilityReport is created automatically for each workload
apiVersion: aquasecurity.github.io/v1alpha1
kind: VulnerabilityReport
metadata:
  name: pod-myapp-myapp
  namespace: default
spec:
  scanner:
    name: Trivy
    version: 0.50.0
report:
  summary:
    criticalCount: 2
    highCount: 5
    mediumCount: 12
    lowCount: 8

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.