# Trivy Vulnerability Scanner Pipeline

> Scans container images, IaC templates, and SBOM artifacts using Aqua Trivy CLI. Generates CycloneDX and SPDX reports with CVE severity filtering for CI/CD gates.

- Skill: `agentskillexchange/trivy-vulnerability-scanner-pipeline` (Agent Skill)
- Install (CLI): `npx skillmds@latest add agentskillexchange/trivy-vulnerability-scanner-pipeline`
- Raw SKILL.md: https://api.skillmd.com/api/skills/agentskillexchange/trivy-vulnerability-scanner-pipeline/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: agentskillexchange (https://skillmd.com/u/agentskillexchange)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/agentskillexchange/trivy-vulnerability-scanner-pipeline

---


# Trivy Vulnerability Scanner Pipeline

Scans container images, IaC templates, and SBOM artifacts using Aqua Trivy CLI. Generates CycloneDX and SPDX reports with CVE severity filtering for CI/CD gates.

## Installation

Requirements and caveats from upstream:
- ![Docker Pulls][docker-pulls]
- docker run aquasec/trivy
- There are canary builds ([Docker Hub](https://hub.docker.com/r/aquasec/trivy/tags?page=1&name=canary), [GitHub](https://github.com/aquasecurity/trivy/pkgs/container/trivy/75776514?tag=canary), [ECR](https://gallery.ec...

Basic usage or getting-started notes:
- ### Get Trivy
- Trivy is available in most common distribution channels. The full list of installation options is available in the [Installation] page. Here are a few popular examples:
- brew install trivy

- Source: https://github.com/aquasecurity/trivy
- Extracted from upstream docs: https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/README.md

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/trivy-vulnerability-scanner-pipeline/)