Trivy Vulnerability Scanner

Scan container images, filesystems, and git repos for CVEs, misconfigurations, exposed secrets, and license issues with Trivy. Covers Docker/OCI images, IaC (Terraform, Kubernetes, Dockerfile), SBOM generation, and gating builds in CI on severity thresholds.

Trivy is Aqua Security's all-in-one open-source scanner. This skill helps you scan container images and filesystems for known vulnerabilities, detect IaC misconfigurations, find hardcoded secrets, generate SBOMs, and wire severity-based failure gates into GitHub Actions or GitLab CI so vulnerable builds never ship.

When to use

Use to scan Docker images before pushing, audit a repo for secrets and CVEs, check Terraform or Kubernetes manifests for misconfigurations, or add a security gate to your CI pipeline.

Examples

Scan a Docker image for CVEs

Find known vulnerabilities before pushing

Scan my Docker image for HIGH and CRITICAL CVEs with Trivy and fail if any are found

Check IaC for misconfigurations

Audit Terraform and Kubernetes manifests

Run Trivy against my Terraform and Kubernetes files to flag insecure configurations

Add a CI security gate

Block vulnerable builds automatically

Add a Trivy scan step to my GitHub Actions workflow that fails the build on CRITICAL vulnerabilities