SkillsAdd

davidcastagnetoa/skills

trivy_image_scanning

Escanear imágenes Docker en busca de vulnerabilidades CVE antes de desplegar

First seen Mar 6, 2026

Installation

$ npx skills add davidcastagnetoa/skills --skill trivy_image_scanning
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

secret-scanning Similar name
github/awesome-copilot

Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, an…

4.4K installs
scanning-with-aws-security-agent Similar name
aws/agent-toolkit-for-aws

Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the …

1.1K installs
diff-scanning-with-aws-security-agent Similar name
aws/agent-toolkit-for-aws

Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the …

1.1K installs
ci-security-scanning-with-strix Similar name
usestrix/strix

Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so eve…

7K installs
vulnerability-scanning Similar name
aj-geddes/useful-ai-prompts

Automated vulnerability detection using OWASP tools, CVE databases, and security scanners. Use …

587 installs
security-scanning-security-hardening Similar name
sickn33/agentic-awesome-skills

Coordinate multi-layer security scanning and hardening across application, infrastructure, and …

527 installs

Also in this package

Other skills from davidcastagnetoa/skills · top by installs.

npx skills add davidcastagnetoa/skills
traefik 116 prisma-nestjs-patterns 58 easyocr 50 exif_metadata_analyzer 30 c4_model_structurizr 28 configurable_thresholds 25 alembic 23 insightface_arcface 19 asyncpg 19 github_actions_cicd 16

Browse all from davidcastagnetoa/skills

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 1
Default branch main
Open issues 0
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 1,868 B
  • docs SUMMARY.md 105 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 5 installs

SKILL.md

trivyimagescanning

Trivy escanea las imágenes Docker del sistema KYC en busca de vulnerabilidades conocidas (CVEs) en las dependencias del sistema operativo y en los paquetes Python. El escaneo se ejecuta en CI y bloquea el deploy si se detectan CVEs críticos.

When to use

Ejecutar en el pipeline de CI después de hacer el docker build. También ejecutar periódicamente sobre las imágenes en producción (nuevas CVEs se descubren constantemente).

Instructions

  1. Instalar: brew install trivy o docker pull aquasec/trivy.
  2. En GitHub Actions (integrado en el skill githubactionscicd):

``yaml - name: Scan image uses: aquasecurity/trivy-action@master with: image-ref: "kyc-api:${{ github.sha }}" format: "table" exit-code: "1" severity: "CRITICAL,HIGH" ignore-unfixed: true ``

  1. ignore-unfixed: true — ignora CVEs sin parche disponible (no hay nada que hacer).
  2. severity: CRITICAL,HIGH — bloquear solo en severidades altas para reducir false positives.
  3. Generar reporte SARIF para GitHub Security tab: format: "sarif", output: "trivy-results.sarif".
  4. Escaneo periódico en producción: CronJob en Kubernetes que escanea imágenes en el registry cada semana.
  5. Configurar .trivyignore para CVEs aceptados con justificación documentada.

Notes

  • Una imagen base actualizada resuelve la mayoría de CVEs — usar python:3.11-slim y actualizarla mensualmente.
  • Trivy también escanea filesystems, repos Git y configuraciones de Kubernetes — no solo imágenes.
  • Los CVEs de dependencias Python se detectan analizando requirements.txt o pip list — complementar con pip-audit.