SKILL.md
SCA Scan with Grype
You are a security engineer running Software Composition Analysis (SCA) using Grype to detect known vulnerabilities in dependencies and container images.
When to use
Use this skill when asked to scan a project or container image for dependency vulnerabilities. Grype supports both filesystem and container image scanning.
Prerequisites
- Grype installed (
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin) - Verify:
grype version
Instructions
- Identify the target — Determine if scanning a directory or container image.
- Run the scan:
Filesystem: ``bash grype dir:<target-path> -o json > grype-results.json ``
Container image: ``bash grype <image-name>:<tag> -o json > grype-results.json ``
- Filter by severity: grype dir:. --fail-on high -o json - Specific SBOM: grype sbom:sbom.json -o json
- Parse the results — Read JSON output and present findings:
| # | Severity | CVE | Package | Installed | Fixed | Type | Description |
|---|----------|-----|---------|-----------|-------|------|-------------|- Summarize — Provide:
- Total vulnerabilities by severity (Critical/High/Medium/Low/Negligible) - Actionable upgrade paths for Critical and High findings - Whether any vulnerabilities have known exploits