# Trivy

> Use for container, filesystem, and IaC review during authorized pentests. Trigger on image assessment, dependency and configuration review, Kubernetes manifest checks, and identifying exposure that affects deployed workloads.

- Skill: `timsonner/trivy` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/trivy`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/trivy/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/trivy

---


# Trivy

## Purpose

Use this skill for focused container, filesystem, and configuration review when the engagement includes build artifacts, images, or IaC.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Threat Modeling and Test Planning, Retest and Closure

## Use When

- Need to assess a container image, source tree, or IaC for material exposure.
- Need to understand whether known package or config risk affects the target.
- Need a repeatable retest after hardening.

## Avoid When

- The target artifact is out of scope.
- Results would be reported without reachability or relevance review.

## Inputs

- Approved image, path, or manifest set
- Scan mode aligned to the current hypothesis
- Output handling requirements

## Procedure

1. Scope the scan to the artifact relevant to the question.
2. Triage findings for material and reachable risk.
3. Correlate important results with deployed context.
4. Avoid flooding the report with low-signal package noise.
5. Preserve the exact artifact and scan mode for retest.

## Command Syntax

Replace sample paths and images with approved in-scope targets.

```bash
# Scan a container image for vulnerabilities
trivy image nginx:latest

# Scan only high and critical severity
trivy image --severity HIGH,CRITICAL nginx:latest

# Output to JSON
trivy image --format json --output contoso-trivy.json nginx:latest

# Scan an IaC configuration directory
trivy config ./terraform/

# Scan filesystem for vulnerabilities, secrets, and misconfigs
trivy fs /path/to/contoso-app/ --scanners vuln,secret,config

# Scan a Kubernetes cluster (summary report)
trivy k8s --report summary cluster

# Scan a specific Kubernetes namespace
trivy k8s --namespace default --report all
```

## Evidence to Capture

- Material image, package, or configuration issues
- Exact artifact and scan mode used
- Reachability or deployment context behind the reported issue

## Safety Boundaries

- Keep scans limited to approved artifacts.
- Treat output as triage input, not final findings without review.