How do I install the Container Security skill?

Run npx skillmds@latest add vbrevik/container-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Container Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Container Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Container Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Container Security?

vbrevik (@vbrevik) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Container Security by vbrevik — Agent Skill

Name: Container Security
Rating: 4.2 (5 reviews)
Author: vbrevik

Container Security

Scan container images, Dockerfiles, docker-compose files, and Kubernetes manifests for security misconfigurations and vulnerabilities. Uses Trivy for image/IaC scanning and Kubescape for K8s policy compliance. Falls back to regex-based Dockerfile and K8s YAML analysis when tools are unavailable. Produces STIG V-ID-tagged findings for /stig-compliance pipeline. Use when (1) reviewing Docker or K8s configuration changes, (2) scanning container images for OS-level CVEs, (3) validating K8s RBAC and NetworkPolicy configuration, (4) before deployment. Works air-gapped with pre-downloaded vulnerability database.

vbrevik Updated Sep 22, 2026

File contents

Container Security Skill

Scans Dockerfiles, docker-compose files, Kubernetes manifests, and container images for security misconfigurations and vulnerabilities.

Invocation

/container-security -- scan all Docker and K8s files in the project
/container-security docker -- scan Dockerfiles and docker-compose files only
/container-security k8s -- scan Kubernetes manifests only
/container-security image <name> -- scan a built container image by name

How It Works

1. Discover files

Find all relevant files in the project:

Dockerfile* (any Dockerfile variant)
docker-compose*.yml / docker-compose*.yaml
*.yaml / *.yml in k8s/ directories or containing K8s apiVersion: fields

Exclude .worktrees/, node_modules/, .git/ directories.

2. Run scanners

Check tool availability and run the appropriate scanner:

# Check tools
which trivy && TRIVY=1 || TRIVY=0
which kubescape && KUBESCAPE=1 || KUBESCAPE=0

If Trivy is available:

bash ~/.claude/skills/container-security/scripts/run_trivy.sh <project-root> /tmp/container-scan.json
python3 ~/.claude/skills/container-security/scripts/trivy_to_findings.py /tmp/container-scan.json --json

If Kubescape is available (K8s mode):

bash ~/.claude/skills/container-security/scripts/run_kubescape.sh <k8s-dir> /tmp/kubescape-scan.json

Fallback (no tools installed):

python3 ~/.claude/skills/container-security/scripts/dockerfile_fallback.py <project-root>

3. Map to STIG V-IDs

All findings are tagged with DISA STIG V-IDs for pipeline integration:

Check	V-ID	CAT
Running as root	V-222548	II
No resource limits	V-222549	II
No health check	V-222549	III
Privileged container	V-222548	I
No NetworkPolicy	V-222545	II
No TLS/HTTPS	V-222543	I
Hardcoded secrets in env	V-222642	I
Latest tag used	V-222548	II
No read-only rootfs	V-222548	II
Base image CVEs	V-222551	varies

See references/stig-rule-mappings.md for the complete mapping table.

4. Output format

Findings are emitted as pipeline-compatible JSON:

{
  "tool": "container-security",
  "timestamp": "2026-03-13T10:00:00Z",
  "target": "/path/to/project",
  "findings": [
    {
      "id": "CS-001",
      "stig_vid": "V-222548",
      "cat": "II",
      "title": "Container runs as root",
      "file": "packages/mocks/Dockerfile",
      "line": null,
      "severity": "MEDIUM",
      "description": "No USER instruction found. Container will run as root.",
      "remediation": "Add a USER instruction to run as a non-root user."
    }
  ],
  "summary": {
    "total": 5,
    "by_cat": {"I": 1, "II": 3, "III": 1},
    "by_severity": {"HIGH": 1, "MEDIUM": 3, "LOW": 1}
  }
}

Prerequisites

Required: Python 3.8+ (for fallback scanner and output formatting)
Optional: Trivy (brew install trivy or binary install) -- IaC and image scanning
Optional: Kubescape (curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | bash) -- K8s policy compliance
Optional: Docker -- required only for image scanning mode

See references/tools-setup.md for installation instructions including air-gapped setup.

Integration with /stig-compliance

Output JSON is compatible with the /stig-compliance pipeline. Findings can be merged with /static-analysis and /dast results for a unified compliance view.

---name: container-securitydescription: Scan container images, Dockerfiles, docker-compose files, and Kubernetes manifests for security misconfigurations and vulnerabilities. Uses Trivy for image/IaC scanning and Kubescape for K8s policy compliance. Falls back to regex-based Dockerfile and K8s YAML analysis when tools are unavailable. Produces STIG V-ID-tagged findings for /stig-compliance pipeline. Use when (1) reviewing Docker or K8s configuration changes, (2) scanning container images for OS-level CVEs, (3) validating K8s RBAC and NetworkPolicy configuration, (4) before deployment. Works air-gapped with pre-downloaded vulnerability database.---# Container Security SkillScans Dockerfiles, docker-compose files, Kubernetes manifests, and container images for security misconfigurations and vulnerabilities.## Invocation- `/container-security` -- scan all Docker and K8s files in the project- `/container-security docker` -- scan Dockerfiles and docker-compose files only- `/container-security k8s` -- scan Kubernetes manifests only- `/container-security image <name>` -- scan a built container image by name## How It Works### 1. Discover filesFind all relevant files in the project:- `Dockerfile*` (any Dockerfile variant)- `docker-compose*.yml` / `docker-compose*.yaml`- `*.yaml` / `*.yml` in `k8s/` directories or containing K8s `apiVersion:` fieldsExclude `.worktrees/`, `node_modules/`, `.git/` directories.### 2. Run scannersCheck tool availability and run the appropriate scanner:```bash# Check toolswhich trivy && TRIVY=1 || TRIVY=0which kubescape && KUBESCAPE=1 || KUBESCAPE=0```**If Trivy is available:**```bashbash ~/.claude/skills/container-security/scripts/run_trivy.sh <project-root> /tmp/container-scan.jsonpython3 ~/.claude/skills/container-security/scripts/trivy_to_findings.py /tmp/container-scan.json --json```**If Kubescape is available (K8s mode):**```bashbash ~/.claude/skills/container-security/scripts/run_kubescape.sh <k8s-dir> /tmp/kubescape-scan.json```**Fallback (no tools installed):**```bashpython3 ~/.claude/skills/container-security/scripts/dockerfile_fallback.py <project-root>```### 3. Map to STIG V-IDsAll findings are tagged with DISA STIG V-IDs for pipeline integration:| Check | V-ID | CAT ||-------|------|-----|| Running as root | V-222548 | II || No resource limits | V-222549 | II || No health check | V-222549 | III || Privileged container | V-222548 | I || No NetworkPolicy | V-222545 | II || No TLS/HTTPS | V-222543 | I || Hardcoded secrets in env | V-222642 | I || Latest tag used | V-222548 | II || No read-only rootfs | V-222548 | II || Base image CVEs | V-222551 | varies |See `references/stig-rule-mappings.md` for the complete mapping table.### 4. Output formatFindings are emitted as pipeline-compatible JSON:```json{ "tool": "container-security", "timestamp": "2026-03-13T10:00:00Z", "target": "/path/to/project", "findings": [ { "id": "CS-001", "stig_vid": "V-222548", "cat": "II", "title": "Container runs as root", "file": "packages/mocks/Dockerfile", "line": null, "severity": "MEDIUM", "description": "No USER instruction found. Container will run as root.", "remediation": "Add a USER instruction to run as a non-root user." } ], "summary": { "total": 5, "by_cat": {"I": 1, "II": 3, "III": 1}, "by_severity": {"HIGH": 1, "MEDIUM": 3, "LOW": 1} }}```## Prerequisites- **Required:** Python 3.8+ (for fallback scanner and output formatting)- **Optional:** Trivy (`brew install trivy` or binary install) -- IaC and image scanning- **Optional:** Kubescape (`curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | bash`) -- K8s policy compliance- **Optional:** Docker -- required only for image scanning modeSee `references/tools-setup.md` for installation instructions including air-gapped setup.## Integration with /stig-complianceOutput JSON is compatible with the `/stig-compliance` pipeline. Findings can be merged with `/static-analysis` and `/dast` results for a unified compliance view.

Frequently asked questions