# Snyk

> Find and fix vulnerabilities in code and dependencies with Snyk. Use when a user asks to scan for security vulnerabilities, audit npm packages, check Docker images for CVEs, or integrate security into CI/CD.

- Skill: `terminalskills/snyk` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add terminalskills/snyk`
- Raw SKILL.md: https://api.skillmd.com/api/skills/terminalskills/snyk/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: terminalskills (https://skillmd.com/u/terminalskills)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/terminalskills/snyk

---


# Snyk

## Overview

Snyk finds and fixes vulnerabilities in open-source dependencies, container images, IaC configs, and code. Integrates into CLI, CI/CD, Git repos, and IDEs.

## Instructions

### Step 1: Setup

```bash
npm install -g snyk
snyk auth
```

### Step 2: Scan Dependencies

```bash
snyk test                    # test for vulnerabilities
snyk monitor                 # continuous monitoring
snyk fix                     # auto-fix vulnerabilities
```

### Step 3: Container Scanning

```bash
snyk container test node:20-alpine
snyk container test my-app:latest --file=Dockerfile
```

### Step 4: IaC Scanning

```bash
snyk iac test                # scan Terraform, K8s manifests
snyk iac test --report       # upload to dashboard
```

## Guidelines

- Free tier: 200 dependency tests/month, unlimited container tests.
- Use `--severity-threshold=high` in CI to fail only on critical issues.
- `snyk fix` auto-generates PRs with dependency upgrades.
- Alternatives: npm audit (basic), GitHub Dependabot (free), Socket.dev (supply chain).