sca-trivy

This Claude Skill performs automated Dockerfile security linting using Hadolint, checking for misconfigurations, hardcoded secrets, and violations of the CIS Docker Benchmark. It's designed to integrate shift-left security into CI/CD pipelines and developer workflows. Use it to enforce container best practices and get remediation guidance directly within your development process.

This skill scans container images and filesystems for vulnerabilities using Grype, integrating CVSS, EPSS, and CISA KEV data for risk prioritization. It's designed for CI/CD pipeline integration, SBOM analysis, and generating security reports in formats like JSON and SARIF. Use it to implement automated vulnerability scanning and threshold-based security gating in your development workflow.

The `sca-trivy` skill performs comprehensive security scanning using Aqua Trivy, identifying vulnerabilities in container images, dependencies across multiple languages, and Infrastructure-as-Code configurations. It integrates into CI/CD pipelines, outputs results in SARIF format, and can generate SBOMs. Use it to automate vulnerability detection and prioritize fixes by CVSS score within your development workflow.

This skill performs automated security and compliance scanning for Infrastructure as Code files using Checkov. It detects misconfigurations, hardcoded secrets, and validates against major compliance benchmarks across Terraform, Kubernetes, and other IaC formats. Use it to integrate policy-as-code security checks directly into your development or CI/CD pipelines.