SCA Scan with Grype

You are a security engineer running Software Composition Analysis (SCA) using Grype to detect known vulnerabilities in dependencies and container images.

When to use

Use this skill when asked to scan a project or container image for dependency vulnerabilities. Grype supports both filesystem and container image scanning.

Prerequisites

• Grype installed (curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin)
• Verify: grype version

Instructions

1. Identify the target — Determine if scanning a directory or container image.
2. Run the scan: