# Vulnerability Scanner

> Runs automated vulnerability scans on codebases, dependencies, and containers. Use when auditing security before deployment or after adding new dependencies.

- Skill: `nikoxkx/vulnerability-scanner` (Agent Skill)
- Install (CLI): `npx skillmds@latest add nikoxkx/vulnerability-scanner`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nikoxkx/vulnerability-scanner/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: Nikoxkx (https://skillmd.com/u/nikoxkx)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/nikoxkx/vulnerability-scanner

---


## Overview

Runs and interprets automated vulnerability scans across code (SAST), dependencies (SCA), containers/images, and infrastructure. Covers tool selection (Snyk, Trivy, Bandit, npm/pip audit, OWASP Dependency-Check, Semgrep), command reference, output interpretation, CVSS severity, remediation priority, CI integration, and a pre-deploy security gate workflow.

## When to Use This Skill

- Before merging or deploying code that touches dependencies or infrastructure.
- After adding or updating third-party packages.
- As part of regular security hygiene or compliance prep.
- The user mentions "scan for vulnerabilities", "security audit", "CVE", or "Snyk/Trivy".

## Prerequisites

- The codebase or container image to scan.
- Tools installed or available via Docker (Trivy, etc.).
- (Recommended) CI pipeline to run scans on every PR and on main.

## Steps

1. **Choose the right tool(s) for the target**:
   - Dependencies (SCA): Snyk, `npm audit`, `pip-audit`, `cargo audit`, OWASP Dependency-Check.
   - Code (SAST): Semgrep, Bandit (Python), `gosec` (Go), SonarQube, CodeQL.
   - Containers / IaC: Trivy (images + Terraform/K8s), Checkov, Terrascan.
   - Secrets: gitleaks, truffleHog (see `secret-detector` skill).

2. **Run the scan** (examples):
   - `trivy image myapp:latest`
   - `snyk test` (after `snyk auth`)
   - `bandit -r src/`
   - `npm audit --audit-level=moderate`

3. **Interpret results**:
   - CVSS 3.x / 4.0 scoring (Critical 9.0-10, High 7.0-8.9, etc.).
   - Reachability / exploitability (Snyk and some tools show this).
   - False positive filtering (common in SAST).

4. **Prioritize remediation**:
   - Critical/High with known exploits in your environment → immediate.
   - Medium → within sprint or before next release.
   - Low → backlog or accept with justification.

5. **CI integration**:
   - Fail the build on Critical/High (configurable threshold).
   - Upload reports as artifacts.
   - Comment on PRs with findings (or use Snyk PR checks).

6. **Output**:
   - Exact commands for the languages/tools in the project.
   - Sample output + how to read it.
   - Recommended CI step (GitHub Action example).
   - Remediation workflow (how to fix a vulnerable dependency safely).
   - Policy: "No Critical or High in main".

## Examples

Full commands + GitHub Actions job for a typical Node + Python + Docker project using Trivy + Snyk + Bandit, with severity thresholds and artifact upload, plus a sample remediation PR description are included.

## Edge Cases & Error Handling

- **False positives**: Document how to suppress with justification (`.snyk` policy, `# nosec`, etc.).
- **Transitive dependencies**: Tools usually surface them; focus on direct where possible.
- **No internet in CI**: Use local vulnerability DBs or cached scans where possible.

## Verification

1. Run the scanner(s) on the current codebase — results are produced.
2. CI job fails (or warns) on injected high-severity issues.
3. A known vulnerable dependency is detected and a fix PR is created.
4. Reports are attached to the build for audit.
5. Success: Critical and High vulnerabilities are caught before they reach production, and the team has a clear process to remediate.

## References

- [Snyk](https://snyk.io/)
- [Trivy](https://trivy.dev/)
- [Bandit](https://bandit.readthedocs.io/)
- [Semgrep](https://semgrep.dev/)
- [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/)
- [CVSS](https://www.first.org/cvss/)