# Image Vulnerability Report

> Use when performing image vulnerability report — generates a detailed vulnerability report for container images across a registry or set of repositories. This template aggregates scan results, tracks remediation progress, and provides executive-level summaries of the organization's container security posture over time.

- Skill: `cloudthinker-ai/image-vulnerability-report` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cloudthinker-ai/image-vulnerability-report`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cloudthinker-ai/image-vulnerability-report/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: cloudthinker-ai (https://skillmd.com/u/cloudthinker-ai)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/cloudthinker-ai/image-vulnerability-report

---


# Image Vulnerability Report

## Phase 1: Inventory

Enumerate all images in scope.

- [ ] Total images in registry: ___
- [ ] Images actively deployed in production: ___
- [ ] Images with latest scan <7 days old: ___
- [ ] Images never scanned: ___
- [ ] Images with no active deployments (candidates for cleanup): ___

| Image Repository | Tags | Last Scan | Deployed | Base OS |
|-----------------|------|-----------|----------|---------|
|                 |      |           |          |         |

## Phase 2: Vulnerability Aggregation

Aggregate findings across all scanned images.

**Fleet-wide Summary:**

| Severity | Total Findings | Unique CVEs | Fix Available (%) | Images Affected |
|----------|---------------|-------------|-------------------|-----------------|
| Critical |               |             |                   |                 |
| High     |               |             |                   |                 |
| Medium   |               |             |                   |                 |
| Low      |               |             |                   |                 |

**Top 10 Most Common CVEs:**

| CVE ID | Severity | Package | Images Affected | Fix Available | Age (days) |
|--------|----------|---------|-----------------|---------------|------------|
|        |          |         |                 |               |            |

## Phase 3: Risk Assessment

- [ ] Identify images with Critical/High CVEs that are internet-facing
- [ ] Cross-reference CVEs against known exploit databases (CISA KEV)
- [ ] Assess blast radius for each critical finding
- [ ] Identify shared base images that amplify risk

**Risk Matrix:**

| Risk Level | Criteria |
|------------|----------|
| Critical | Known exploited CVE in internet-facing production image |
| High | Critical CVE with fix available in production image |
| Medium | High CVE in production or Critical in non-production |
| Low | Medium/Low CVE or finding in non-production only |

## Phase 4: Trend Analysis

Compare to previous reporting period.

| Metric | Previous Period | Current Period | Trend |
|--------|----------------|----------------|-------|
| Total Critical CVEs | | | |
| Total High CVEs | | | |
| Mean time to remediate (Critical) | | | |
| Mean time to remediate (High) | | | |
| Images with zero Critical/High | | | |
| Scan coverage (%) | | | |

## Phase 5: Remediation Tracking

| CVE/Finding | Affected Images | Owner | Status | Target Date | Notes |
|-------------|----------------|-------|--------|-------------|-------|
|             |                |       |        |             |       |

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format

### Executive Summary

- **Total images scanned:** ___
- **Scan coverage:** ___%
- **Critical findings requiring immediate action:** ___
- **Mean time to remediate (Critical):** ___ days
- **Security posture trend:** Improving / Stable / Declining

### Action Items

- [ ] Remediate all Critical CVEs with known exploits within 48 hours
- [ ] Patch remaining Critical CVEs within 7 days
- [ ] Scan all unscanned images and add to pipeline
- [ ] Clean up unused images from registry
- [ ] Update shared base images to patched versions
- [ ] Report posture to security leadership