[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F4YC4CDFBS1HDC2RYW47S6":3,"skill-same:01M6F4YC4CDFBS1HDC2RYW47S6":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":21,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M6F4YC4CDFBS1HDC2RYW47S6","container-scanning",null,"Scan container images for vulnerabilities using Trivy, Grype, and cloud-native tools.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-container-scanning\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"container scanning","scanning","container","main","2026","scan container images for vulnerabilities","relevant","native","scripts","scope","critical","active","scan","security","community","images","cloud-native","only","devops-security","Tools","grype","assessment","2026-11-10 10:12:30",false,"---\nname: container-scanning\ndescription: Scan container images for vulnerabilities using Trivy, Grype, and cloud-native\n  tools.\ncategory: security\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant security tooling (scanners, vault CLIs) and an\n  authorized scope for any active assessment. Docs-only; helper scripts and templates\n  not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# Container Scanning\n\nScan container images for vulnerabilities and security misconfigurations.\n\n## When to Use This Skill\n\nUse this skill when:\n- Building container images\n- Implementing container security gates\n- Scanning registry images\n- Meeting compliance requirements\n- Hardening container deployments\n\n## Prerequisites\n\n- Container runtime (Docker, Podman)\n- Container images to scan\n- Scanning tool installation\n\n## Tool Comparison\n\n| Tool | License | Speed | Features |\n|------|---------|-------|----------|\n| Trivy | OSS | Fast | Comprehensive, IaC |\n| Grype | OSS | Fast | Accurate, SBOM |\n| Clair | OSS | Medium | Registry integration |\n| Snyk Container | Commercial | Fast | Fix suggestions |\n| Docker Scout | Commercial | Fast | GitHub integration |\n\n## Trivy\n\n### Installation\n\n```bash\n# Linux\n# Tool prerequisite: use a verified preinstalled binary; no network installer runs here.\n\n# macOS\nbrew install trivy\n\n# Docker\ndocker pull aquasec\u002Ftrivy\n```\n\n### Image Scanning\n\n```bash\n# Scan local image\ntrivy image myapp:latest\n\n# Scan remote image\ntrivy image nginx:1.25\n\n# JSON output\ntrivy image --format json -o results.json myapp:latest\n\n# Filter by severity\ntrivy image --severity HIGH,CRITICAL myapp:latest\n\n# Optional filtered view; retain an unfiltered report of unfixed risk too.\ntrivy image --ignore-unfixed myapp:latest\n\n# Exit code on vulnerability\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\n```\n\n### Filesystem Scanning\n\n```bash\n# Scan project directory\ntrivy fs \u002Fpath\u002Fto\u002Fproject\n\n# Scan Dockerfile\ntrivy config Dockerfile\n\n# Scan Kubernetes manifests\ntrivy config k8s\u002F\n```\n\n### Configuration\n\n```yaml\n# trivy.yaml\ntimeout: 10m\nseverity:\n  - HIGH\n  - CRITICAL\nignore-unfixed: true\nexit-code: 1\n\nvulnerability:\n  type:\n    - os\n    - library\n\nscan:\n  file-patterns:\n    - \"Dockerfile\"\n    - \"*.yaml\"\n```\n\n### CI Integration\n\n```text\nNON-EXECUTABLE CI DESIGN: before adoption, use least-privilege jobs, pin every action to a reviewed full SHA, and provision verified fixed-version tools in a digest-pinned runner image. Never expose credentials during tool provisioning.\n# GitHub Actions\nname: Container Security\n\non:\n  push:\n    branches: [main]\n  pull_request:\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Run Trivy\n        step: Run the preinstalled reviewed Trivy binary\n        with:\n          image-ref: 'myapp:${{ github.sha }}'\n          format: 'sarif'\n          output: 'trivy-results.sarif'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n\n      - name: Upload results\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        with:\n          sarif_file: 'trivy-results.sarif'\n```\n\n## Grype\n\n### Installation\n\n```bash\n# Linux\u002FmacOS\n# Tool prerequisite: use a verified preinstalled binary; no network installer runs here.\n\n# Homebrew\nbrew install grype\n```\n\n### Usage\n\n```bash\n# Scan image\ngrype myapp:latest\n\n# Scan from SBOM\ngrype sbom:.\u002Fsbom.json\n\n# JSON output\ngrype myapp:latest -o json > results.json\n\n# Filter severity\ngrype myapp:latest --fail-on high\n\n# Scan directory\ngrype dir:\u002Fpath\u002Fto\u002Fproject\n```\n\n### Configuration\n\n```yaml\n# .grype.yaml\ncheck-for-app-update: false\nfail-on-severity: high\noutput: \"json\"\nscope: \"Squashed\"\n\nignore:\n  - vulnerability: CVE-2023-12345\n    reason: \"False positive\"\n    expires: \"2024-12-31\"\n```\n\n## Docker Scout\n\n### Usage\n\n```bash\n# Enable Docker Scout\ndocker scout quickview myapp:latest\n\n# Full CVE report\ndocker scout cves myapp:latest\n\n# Compare images\ndocker scout compare myapp:v1 myapp:v2\n\n# Recommendations\ndocker scout recommendations myapp:latest\n```\n\n### CI Integration\n\n```text\nNON-EXECUTABLE CI DESIGN: before adoption, use least-privilege jobs, pin every action to a reviewed full SHA, and provision verified fixed-version tools in a digest-pinned runner image. Never expose credentials during tool provisioning.\n- name: Docker Scout\n  uses: docker\u002Fscout-action@v1\n  with:\n    command: cves\n    image: ${{ env.IMAGE_NAME }}\n    sarif-file: scout-results.sarif\n    summary: true\n```\n\n## Registry Integration\n\n### Amazon ECR\n\n```bash\n# Enable scan on push\naws ecr put-image-scanning-configuration \\\n  --repository-name myapp \\\n  --image-scanning-configuration scanOnPush=true\n\n# Get scan findings\naws ecr describe-image-scan-findings \\\n  --repository-name myapp \\\n  --image-id imageTag=latest\n\n# Start manual scan\naws ecr start-image-scan \\\n  --repository-name myapp \\\n  --image-id imageTag=latest\n```\n\n### Azure ACR\n\n```bash\n# Enable Defender for Containers\naz security pricing create \\\n  --name Containers \\\n  --tier Standard\n\n# Read Defender vulnerability findings through its supported findings API\u002Fportal.\n# az acr repository show returns image metadata, not a vulnerability report.\n```\n\n### Google Artifact Registry\n\n```bash\n# Enable vulnerability scanning\ngcloud artifacts repositories update myrepo \\\n  --location=us-central1 \\\n  --enable-vulnerability-scanning\n\n# View vulnerabilities\ngcloud artifacts docker images describe \\\n  us-central1-docker.pkg.dev\u002Fproject\u002Fmyrepo\u002Fmyapp:latest \\\n  --show-package-vulnerability\n```\n\n## Admission example boundaries\n\nThe Gatekeeper\u002FKyverno snippets are incomplete\u002Fversion-specific sketches, not enforceable proof of scan policy. Pin actual CRDs\u002FRego syntax, supply required Constraint\u002Ftrusted attestor configuration, and test accept\u002Freject cases before cluster admission. Repository prefix checks require a normalized boundary (for example an approved registry\u002Fpath plus `\u002F`), not an attacker-lookalike prefix; cover init and ephemeral containers. A `verifyImages` predicate needs a verified signer\u002Fissuer and actual predicate schema, not an invented `scanner` variable. The `scan-policy.yaml` below is conceptual, with no bundled consumer. Record image digest, scanner\u002FDB versions, date, exclusions and residual unfixed findings; a clean scan is not certification.\n\n## Admission Controllers\n\n### OPA Gatekeeper\n\n```yaml\napiVersion: templates.gatekeeper.sh\u002Fv1beta1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sallowedrepos\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sAllowedRepos\n      validation:\n        openAPIV3Schema:\n          properties:\n            repos:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sallowedrepos\n        \n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          satisfied := [good | repo = input.parameters.repos[_]; good = startswith(container.image, repo)]\n          not any(satisfied)\n          msg := sprintf(\"container \u003C%v> has an invalid image repo \u003C%v>\", [container.name, container.image])\n        }\n```\n\n### Kyverno\n\n```yaml\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-image-scan\nspec:\n  validationFailureAction: enforce\n  rules:\n    - name: check-vulnerabilities\n      match:\n        resources:\n          kinds:\n            - Pod\n      verifyImages:\n        - image: \"*\"\n          attestations:\n            - predicateType: cosign.sigstore.dev\u002Fattestation\u002Fvuln\u002Fv1\n              conditions:\n                - all:\n                    - key: \"{{ scanner.result.summary.criticalCount }}\"\n                      operator: Equals\n                      value: \"0\"\n```\n\n## Scanning Policies\n\n### Policy Definition\n\n```yaml\n# scan-policy.yaml\npolicies:\n  - name: critical-vulnerabilities\n    description: Block images with critical CVEs\n    severity: CRITICAL\n    action: block\n    \n  - name: high-vulnerabilities\n    description: Warn on high severity CVEs\n    severity: HIGH\n    action: warn\n    max_count: 5\n    \n  - name: age-policy\n    description: Block images older than 30 days\n    max_age_days: 30\n    action: block\n    \n  - name: base-image\n    description: Only allow approved base images\n    allowed_bases:\n      - alpine:3.18\n      - ubuntu:22.04\n      - python:3.11-slim\n```\n\n## Common Issues\n\n### Issue: False Positives\n**Problem**: Scanner reports non-exploitable vulnerabilities\n**Solution**: Use ignore files, validate with context\n\n### Issue: Slow Scans\n**Problem**: Scanning takes too long\n**Solution**: Use caching, scan incrementally, optimize image layers\n\n### Issue: Unfixed Vulnerabilities\n**Problem**: No patch available for CVE\n**Solution**: Update base image, implement compensating controls\n\n## Best Practices\n\n- Scan in CI\u002FCD pipeline\n- Use minimal base images (Alpine, distroless)\n- Update base images regularly\n- Implement admission control\n- Track vulnerabilities over time\n- Set severity thresholds\n- Document accepted risks\n- Use multi-stage builds\n\n## Related Skills\n\n- docker-management (`docker-management`) - Container basics\n- container-hardening (`container-hardening`) - Security hardening\n- kubernetes-hardening (`kubernetes-hardening`) - K8s security\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# Container Scanning\n\nScan container images for vulnerabilities and security misconfigurations.\n\n## When to Use This Skill\n\nUse this skill when:\n- Building container images\n- Implementing container security gates\n- Scanning registry images\n- Meeting compliance requirements\n- Hardening container deployments\n\n## Prerequisites\n\n- Container runtime (Docker, Podman)\n- Container images to scan\n- Scanning tool installation\n\n## Tool Comparison\n\n| Tool | License | Speed | Features |\n|------|---------|-------|----------|\n| Trivy | OSS | Fast | Comprehensive, IaC |\n| Grype | OSS | Fast | Accurate, SBOM |\n| Clair | OSS | Medium | Registry integration |\n| Snyk Container | Commercial | Fast | Fix suggestions |\n| Docker Scout | Commercial | Fast | GitHub integration |\n\n## Trivy\n\n### Installation\n\n```bash\n# Linux\n# Tool prerequisite: use a verified preinstalled binary; no network installer runs here.\n\n# macOS\nbrew install trivy\n\n# Docker\ndocker pull aquasec\u002Ftrivy\n```\n\n### Image Scanning\n\n```bash\n# Scan local image\ntrivy image myapp:latest\n\n# Scan remote image\ntrivy image nginx:1.25\n\n# JSON output\ntrivy image --format json -o results.json myapp:latest\n\n# Filter by severity\ntrivy image --severity HIGH,CRITICAL myapp:latest\n\n# Optional filtered view; retain an unfiltered report of unfixed risk too.\ntrivy image --ignore-unfixed myapp:latest\n\n# Exit code on vulnerability\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\n```\n\n### Filesystem Scanning\n\n```bash\n# Scan project directory\ntrivy fs \u002Fpath\u002Fto\u002Fproject\n\n# Scan Dockerfile\ntrivy config Dockerfile\n\n# Scan Kubernetes manifests\ntrivy config k8s\u002F\n```\n\n### Configuration\n\n```yaml\n# trivy.yaml\ntimeout: 10m\nseverity:\n  - HIGH\n  - CRITICAL\nignore-unfixed: true\nexit-code: 1\n\nvulnerability:\n  type:\n    - os\n    - library\n\nscan:\n  file-patterns:\n    - \"Dockerfile\"\n    - \"*.yaml\"\n```\n\n### CI Integration\n\n```text\nNON-EXECUTABLE CI DESIGN: before adoption, use least-privilege jobs, pin every action to a reviewed full SHA, and provision verified fixed-version tools in a digest-pinned runner image. Never expose credentials during tool provisioning.\n# GitHub Actions\nname: Container Security\n\non:\n  push:\n    branches: [main]\n  pull_request:\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Run Trivy\n        step: Run the preinstalled reviewed Trivy binary\n        with:\n          image-ref: 'myapp:${{ github.sha }}'\n          format: 'sarif'\n          output: 'trivy-results.sarif'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n\n      - name: Upload results\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        with:\n          sarif_file: 'trivy-results.sarif'\n```\n\n## Grype\n\n### Installation\n\n```bash\n# Linux\u002FmacOS\n# Tool prerequisite: use a verified preinstalled binary; no network installer runs here.\n\n# Homebrew\nbrew install grype\n```\n\n### Usage\n\n```bash\n# Scan image\ngrype myapp:latest\n\n# Scan from SBOM\ngrype sbom:.\u002Fsbom.json\n\n# JSON output\ngrype myapp:latest -o json > results.json\n\n# Filter severity\ngrype myapp:latest --fail-on high\n\n# Scan directory\ngrype dir:\u002Fpath\u002Fto\u002Fproject\n```\n\n### Configuration\n\n```yaml\n# .grype.yaml\ncheck-for-app-update: false\nfail-on-severity: high\noutput: \"json\"\nscope: \"Squashed\"\n\nignore:\n  - vulnerability: CVE-2023-12345\n    reason: \"False positive\"\n    expires: \"2024-12-31\"\n```\n\n## Docker Scout\n\n### Usage\n\n```bash\n# Enable Docker Scout\ndocker scout quickview myapp:latest\n\n# Full CVE report\ndocker scout cves myapp:latest\n\n# Compare images\ndocker scout compare myapp:v1 myapp:v2\n\n# Recommendations\ndocker scout recommendations myapp:latest\n```\n\n### CI Integration\n\n```text\nNON-EXECUTABLE CI DESIGN: before adoption, use least-privilege jobs, pin every action to a reviewed full SHA, and provision verified fixed-version tools in a digest-pinned runner image. Never expose credentials during tool provisioning.\n- name: Docker Scout\n  uses: docker\u002Fscout-action@v1\n  with:\n    command: cves\n    image: ${{ env.IMAGE_NAME }}\n    sarif-file: scout-results.sarif\n    summary: true\n```\n\n## Registry Integration\n\n### Amazon ECR\n\n```bash\n# Enable scan on push\naws ecr put-image-scanning-configuration \\\n  --repository-name myapp \\\n  --image-scanning-configuration scanOnPush=true\n\n# Get scan findings\naws ecr describe-image-scan-findings \\\n  --repository-name myapp \\\n  --image-id imageTag=latest\n\n# Start manual scan\naws ecr start-image-scan \\\n  --repository-name myapp \\\n  --image-id imageTag=latest\n```\n\n### Azure ACR\n\n```bash\n# Enable Defender for Containers\naz security pricing create \\\n  --name Containers \\\n  --tier Standard\n\n# Read Defender vulnerability findings through its supported findings API\u002Fportal.\n# az acr repository show returns image metadata, not a vulnerability report.\n```\n\n### Google Artifact Registry\n\n```bash\n# Enable vulnerability scanning\ngcloud artifacts repositories update myrepo \\\n  --location=us-central1 \\\n  --enable-vulnerability-scanning\n\n# View vulnerabilities\ngcloud artifacts docker images describe \\\n  us-central1-docker.pkg.dev\u002Fproject\u002Fmyrepo\u002Fmyapp:latest \\\n  --show-package-vulnerability\n```\n\n## Admission example boundaries\n\nThe Gatekeeper\u002FKyverno snippets are incomplete\u002Fversion-specific sketches, not enforceable proof of scan policy. Pin actual CRDs\u002FRego syntax, supply required Constraint\u002Ftrusted attestor configuration, and test accept\u002Freject cases before cluster admission. Repository prefix checks require a normalized boundary (for example an approved registry\u002Fpath plus `\u002F`), not an attacker-lookalike prefix; cover init and ephemeral containers. A `verifyImages` predicate needs a verified signer\u002Fissuer and actual predicate schema, not an invented `scanner` variable. The `scan-policy.yaml` below is conceptual, with no bundled consumer. Record image digest, scanner\u002FDB versions, date, exclusions and residual unfixed findings; a clean scan is not certification.\n\n## Admission Controllers\n\n### OPA Gatekeeper\n\n```yaml\napiVersion: templates.gatekeeper.sh\u002Fv1beta1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sallowedrepos\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sAllowedRepos\n      validation:\n        openAPIV3Schema:\n          properties:\n            repos:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sallowedrepos\n        \n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          satisfied := [good | repo = input.parameters.repos[_]; good = startswith(container.image, repo)]\n          not any(satisfied)\n          msg := sprintf(\"container \u003C%v> has an invalid image repo \u003C%v>\", [container.name, container.image])\n        }\n```\n\n### Kyverno\n\n```yaml\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-image-scan\nspec:\n  validationFailureAction: enforce\n  rules:\n    - name: check-vulnerabilities\n      match:\n        resources:\n          kinds:\n            - Pod\n      verifyImages:\n        - image: \"*\"\n          attestations:\n            - predicateType: cosign.sigstore.dev\u002Fattestation\u002Fvuln\u002Fv1\n              conditions:\n                - all:\n                    - key: \"{{ scanner.result.summary.criticalCount }}\"\n                      operator: Equals\n                      value: \"0\"\n```\n\n## Scanning Policies\n\n### Policy Definition\n\n```yaml\n# scan-policy.yaml\npolicies:\n  - name: critical-vulnerabilities\n    description: Block images with critical CVEs\n    severity: CRITICAL\n    action: block\n    \n  - name: high-vulnerabilities\n    description: Warn on high severity CVEs\n    severity: HIGH\n    action: warn\n    max_count: 5\n    \n  - name: age-policy\n    description: Block images older than 30 days\n    max_age_days: 30\n    action: block\n    \n  - name: base-image\n    description: Only allow approved base images\n    allowed_bases:\n      - alpine:3.18\n      - ubuntu:22.04\n      - python:3.11-slim\n```\n\n## Common Issues\n\n### Issue: False Positives\n**Problem**: Scanner reports non-exploitable vulnerabilities\n**Solution**: Use ignore files, validate with context\n\n### Issue: Slow Scans\n**Problem**: Scanning takes too long\n**Solution**: Use caching, scan incrementally, optimize image layers\n\n### Issue: Unfixed Vulnerabilities\n**Problem**: No patch available for CVE\n**Solution**: Update base image, implement compensating controls\n\n## Best Practices\n\n- Scan in CI\u002FCD pipeline\n- Use minimal base images (Alpine, distroless)\n- Update base images regularly\n- Implement admission control\n- Track vulnerabilities over time\n- Set severity thresholds\n- Document accepted risks\n- Use multi-stage builds\n\n## Related Skills\n\n- docker-management (`docker-management`) - Container basics\n- container-hardening (`container-hardening`) - Security hardening\n- kubernetes-hardening (`kubernetes-hardening`) - K8s security\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":28,"source":45,"license":14,"category":31,"metadata":46,"date_added":49,"description":7,"source_repo":50,"source_type":32,"compatibility":51,"license_source":52},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills",{"author":47,"version":48},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-container-scanning",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-12 14:21:24",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add boisenoise\u002Fskills-collections --skill container-scanning",{"tool":65,"command":66},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill container-scanning",{"tool":68,"command":69},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill container-scanning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-container-scanning\u002FSKILL.md",true,[],[74,100,128,154,173,196],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":79,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":40},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[83,84,85,86,87,88,89,90,37,91,92,35,93,94,95,28,96,97,98,99,22],"web","access","web access","official","development","browser","search","data","read","fetch","youtube","free tools","platform","free","cover","normal","when",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":104,"sourceHtmlUrl":105,"categories":106,"keywords":112,"publishedAt":40},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[107],{"categoryNo":108,"categoryName":109,"taxonomyType":110,"taxonomyTypeDesc":111},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[102,113,114,115,86,87,116,37,117,118,119,120,121,122,123,28,124,125,126,127,22],"MCP","cli","github","license","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":132,"sourceHtmlUrl":133,"categories":134,"keywords":140,"publishedAt":40},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[135],{"categoryNo":136,"categoryName":137,"taxonomyType":138,"taxonomyTypeDesc":139},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[130,115,86,116,141,142,143,144,145,146,28,147,148,149,125,150,151,152,153,127,102,22],"https","email","enrichment","business","evidence","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":158,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":40},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[162,163,164,115,86,116,165,166,141,167,117,168,169,170,145,28,171,172,127,102,22],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":177,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":40},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[181,182,115,183,86,184,116,185,186,187,188,189,28,190,191,192,193,194,195,127],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":200,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":40},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[204,205,206,115,86,116,207,208,144,209,210,28,211,212,213,214,215,216,217,127],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]