Skill

scanning-containers-with-trivy-in-cicd

skill:mukul975/anthropic-cybersecurity-skills#scanning-containers-with-trivy-in-cicd

Integrates Aqua Security's Trivy scanner into CI/CD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and to enforce severity-based quality gates that block vulnerable images from being deployed. Use when building Docker images in CI/CD and needing automated vulnerability scanning and pass/fail gates before registry push or production deployment.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:16 UTC at 54a7988

findings

medium

highest severity

threat classes

4,532

files scanned

168/168

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/scanning-containers-with-trivy-in-cicd:skills/scanning-containers-with-trivy-in-cicd/SKILL.md:160:SUPPLY

Security findings 1

Supply chain

mediumContextual riskmedium confidence

The skill's GitLab CI/CD example and its CI/CD integration reference instruct the agent to run the vendor scanner container by the mutable 'latest' tag instead of a pinned version or digest, so the code executed in the CI pipeline can change without notice.

skills/scanning-containers-with-trivy-in-cicd/SKILL.md:160

name: aquasec/trivy:latest

vector:instruction

Counter-argument considered

Both the GitLab CI example in the skill body and the CI/CD integration table direct execution of the vendor scanner by the mutable ':latest' tag, so the code the pipeline runs can change without notice; this sits outside the pinned-official-registry-install carve-out, is undeclared (the skill's own guidance treats ':latest' as a misconfiguration), and is a concrete instruction an agent following the skill will reproduce. No mitigation exists in the shown units, so the finding stands.