Execute use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like "scan for vulnerabilities", "implement security controls", or "audit security".
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill scanning-container-securityLoading…
Scan container images and Dockerfiles for vulnerabilities, misconfigurations, and compliance violations using Trivy, Grype, Snyk Container, and Hadolint. Analyze base images, OS packages, application dependencies, and runtime configurations to produce actionable security reports with remediation guidance.
trivy, grype, snyk, or docker scouthadolint for Dockerfile best practice validationjq for parsing JSON scan resultshadolint Dockerfile to catch misconfigurations before build (privileged instructions, pinned versions, shell best practices)trivy image <image:tag> or grype <image:tag>trivy image --scanners secret <image:tag>| Error | Cause | Solution |
|---|---|---|
trivy: unable to pull image | Image not found locally or registry auth failure | Pull image first with docker pull or configure registry credentials |
CRITICAL vulnerability found but no fix available | Upstream package has no patch yet | Document as accepted risk, use --ignore-unfixed flag, or switch to an alternative base image |
hadolint: DL3008 pin versions in apt-get install | Packages installed without version pinning | Add version pins (e.g., apt-get install nginx=1.24.0-1) or use --no-install-recommends |
Scan timeout on large image | Image has many layers or large filesystem | Use --timeout 15m flag; scan a specific layer or use --skip-dirs to exclude test data |
False positive CVE | Scanner database maps CVE to a package not actually exploitable | Add to .trivyignore or Grype ignore file with justification comment |
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).