alivirgo Snyk Security Scanning AI Skill Guide
Overview & Engine Architecture
Snyk scans applications for vulnerable dependencies (Open Source), container images, IaC misconfigs, and optionally code issues. Results flow to the Snyk UI and CI. Agents prioritize reachable/high-severity issues, prefer upgrade paths over endless ignores, and wire gates that match the team's risk appetite.
Manifests / lockfiles / Dockerfiles / IaC
-> snyk test | monitor | container test | iac test
-> Vulnerability DB + policy
-> Fix PRs / ignores / CI fail
When to use this skill
- Adding dependency scanning to repos and pipelines
- Triaging CVEs in npm/pip/maven lockfiles
- Scanning container images before deploy
- Setting org ignore policies with expiry
Operational directives
- Commit lockfiles; Snyk accuracy depends on resolved trees.
- Fix by upgrading or replacing packages before ignoring.
- Ignores need reason + expiry; permanent ignores for highs are exceptional.
- Use
snyk monitorfor continuous tracking;snyk testfor PR gates. - Never paste Snyk tokens into source; use CI secrets.
CLI sketches
snyk auth
snyk test --severity=package-lock.json
snyk test --severity=high --json-file-output=snyk.json
snyk container test myimage:tag
snyk iac test terraform/
snyk ignore --id=SNYK-JS-LODASH-123 --expiry=2026-12-01 --reason="Mitigated by input validation; upgrade blocked"
Triage matrix
| Finding | Prefer |
|---|---|
| Patch version available | Bump lockfile ASAP |
| Major upgrade breaking | Schedule upgrade epic; temporary ignore with expiry |
| Dev-only dependency, not shipped | Still fix; lower gate severity if policy allows |
| False positive / unreachable | Document ignore; link to analysis |
Best practices
- Separate app SCA gates from container/IaC projects for clearer ownership.
- Fail PRs on new highs/criticals introduced by the change; baseline debt via backlog.
- Pair with
@semgrep/@codeqlfor first-party code bugs SCA cannot see. - Rebuild images after base-image fixes; rescanning an old tag is not remediation.
Limitations
- Reachability analysis quality varies by ecosystem and plan features.
- Private registry auth must be configured or scans miss/partial trees.
- License scanning policies are org-specific and may block otherwise "safe" packages.
Related skills
@dependabot-config- automated dependency PR companion@semgrep/@codeql- SAST companions@docker- image rebuild and minimal base practices@owasp-asvs- map dependency risk into verification evidence