Vulnerability Scanner

Overview

Runs and interprets automated vulnerability scans across code (SAST), dependencies (SCA), containers/images, and infrastructure. Covers tool selection (Snyk, Trivy, Bandit, npm/pip audit, OWASP Dependency-Check, Semgrep), command reference, output interpretation, CVSS severity, remediation priority, CI integration, and a pre-deploy security gate workflow.

When to Use This Skill

• Before merging or deploying code that touches dependencies or infrastructure.
• After adding or updating third-party packages.
• As part of regular security hygiene or compliance prep.
• The user mentions "scan for vulnerabilities", "security audit", "CVE", or "Snyk/Trivy".

Prerequisites

• The codebase or container image to scan.
• Tools installed or available via Docker (Trivy, etc.).
• (Recommended) CI pipeline to run scans on every PR and on main.

Steps

1. Choose the right tool(s) for the target:

   • Dependencies (SCA): Snyk, npm audit, pip-audit, cargo audit, OWASP Dependency-Check.
   • Code (SAST): Semgrep, Bandit (Python), gosec (Go), SonarQube, CodeQL.
   • Containers / IaC: Trivy (images + Terraform/K8s), Checkov, Terrascan.
   • Secrets: gitleaks, truffleHog (see secret-detector skill).

2. Run the scan (examples):

   • trivy image myapp:latest
   • snyk test (after snyk auth)
   • bandit -r src/
   • npm audit --audit-level=moderate

3. Interpret results:

   • CVSS 3.x / 4.0 scoring (Critical 9.0-10, High 7.0-8.9, etc.).
   • Reachability / exploitability (Snyk and some tools show this).
   • False positive filtering (common in SAST).

4. Prioritize remediation:

   • Critical/High with known exploits in your environment → immediate.
   • Medium → within sprint or before next release.
   • Low → backlog or accept with justification.

5. CI integration:

   • Fail the build on Critical/High (configurable threshold).
   • Upload reports as artifacts.
   • Comment on PRs with findings (or use Snyk PR checks).

6. Output:

   • Exact commands for the languages/tools in the project.
   • Sample output + how to read it.
   • Recommended CI step (GitHub Action example).
   • Remediation workflow (how to fix a vulnerable dependency safely).
   • Policy: "No Critical or High in main".

Examples

Full commands + GitHub Actions job for a typical Node + Python + Docker project using Trivy + Snyk + Bandit, with severity thresholds and artifact upload, plus a sample remediation PR description are included.

Edge Cases & Error Handling

• False positives: Document how to suppress with justification (.snyk policy, # nosec, etc.).
• Transitive dependencies: Tools usually surface them; focus on direct where possible.
• No internet in CI: Use local vulnerability DBs or cached scans where possible.

Verification

1. Run the scanner(s) on the current codebase — results are produced.
2. CI job fails (or warns) on injected high-severity issues.
3. A known vulnerable dependency is detected and a fix PR is created.
4. Reports are attached to the build for audit.
5. Success: Critical and High vulnerabilities are caught before they reach production, and the team has a clear process to remediate.

References

• Snyk
• Trivy
• Bandit
• Semgrep
• OWASP Dependency-Check
• CVSS