Aqua Trivy Vulnerability Scanning AI Skill Guide

Overview

Trivy scans container images, filesystems, Git repos, Kubernetes manifests, and Terraform/CloudFormation for OS packages, language libraries, secrets, and misconfigurations. It is widely used as a CI gate. Agents should report actionable findings (fixable base, upgraded package) and avoid failing builds on unfixed noise without a documented policy.

Target (image | fs | repo | k8s)
        |
        v
Trivy DB + checks
        |
        +--> vulnerabilities (CVE)
        +--> misconfig / secrets
        +--> SBOM (optional)

When to use