The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the Trivy scanner from official and trusted sources, including GitHub (aquasecurity/trivy), Homebrew, and the official Docker Hub repository (aquasec/trivy). These are well-known, authoritative sources for this technology.
[COMMAND_EXECUTION]: The documentation includes standard shell commands for container image scanning (e.g., trivy image {image}). It includes recommendations for safe execution, such as running the scanner within a Docker container to isolate the environment.
[PRIVILEGE_ESCALATION]: Installation instructions mention the use of sudo for package managers (apt-get, dnf). This is the standard and expected procedure for system-level package installation and does not represent a security risk in this context.
[PROMPT_INJECTION]: The skill contains an evals directory with complex scenarios designed to test an agent's ability to handle security trade-offs, policy enforcement, and scanner configuration. These scenarios involve analyzing intentional misconfigurations or security lapses in a testing context and do not contain malicious instructions directed at the agent's core safety filters.
[SAFE]: The skill emphasizes security hardening by recommending pinned version tags instead of floating tags (like :latest) to ensure CI/CD determinism and prevent the silent introduction of breaking changes or unverified scanner versions.

trivy-image