[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6H520K6R4MFZPW31R7RBT42":3,"skill-same:01M6H520K6R4MFZPW31R7RBT42":95},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6H520K6R4MFZPW31R7RBT42","scanning-container-security",null,"Execute use when you need to work with security and compliance.\nThis skill provides security scanning and vulnerability detection with comprehensive guidance and automation.\nTrigger with phrases like \"scan for vulnerabilities\", \"implement security controls\",\nor \"audit security\".","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fdevops\u002Fcontainer-security-scanner\u002Fskills\u002Fscanning-container-security\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"security","container security","Scanning Container Security","container","scanning","vulnerability","Bash","use","code","automation","implement","security scanning","scan","docker","io","trigger","controls","with","you","for","2026-11-10 10:12:30",false,"---\nname: scanning-container-security\ndescription: |\n  Execute use when you need to work with security and compliance.\n  This skill provides security scanning and vulnerability detection with comprehensive guidance and automation.\n  Trigger with phrases like \"scan for vulnerabilities\", \"implement security controls\",\n  or \"audit security\".\n\nallowed-tools: Read, Write, Edit, Grep, Glob, Bash(docker:*), Bash(kubectl:*)\nversion: 1.0.0\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\nlicense: MIT\ncompatible-with: claude-code, codex, openclaw\n---\n# Scanning Container Security\n\n## Overview\n\nScan container images and Dockerfiles for vulnerabilities, misconfigurations, and compliance violations using Trivy, Grype, Snyk Container, and Hadolint. Analyze base images, OS packages, application dependencies, and runtime configurations to produce actionable security reports with remediation guidance.\n\n## Prerequisites\n\n- Container scanning tool installed: `trivy`, `grype`, `snyk`, or `docker scout`\n- Dockerfile linter: `hadolint` for Dockerfile best practice validation\n- Docker daemon running for local image scanning\n- Access to the container images to scan (local, registry, or tar archive)\n- `jq` for parsing JSON scan results\n\n## Instructions\n\n1. Identify target images for scanning: production images, base images, and CI-built images\n2. Lint Dockerfiles with `hadolint Dockerfile` to catch misconfigurations before build (privileged instructions, pinned versions, shell best practices)\n3. Scan built images for OS-level vulnerabilities: `trivy image \u003Cimage:tag>` or `grype \u003Cimage:tag>`\n4. Scan for application dependency vulnerabilities: check language-specific packages (npm, pip, Maven, Go modules) embedded in the image\n5. Check for secrets accidentally baked into image layers: `trivy image --scanners secret \u003Cimage:tag>`\n6. Evaluate image against CIS Docker Benchmark: verify non-root user, read-only filesystem capability, health checks defined\n7. Generate a security report with severity classification (Critical, High, Medium, Low) and CVE identifiers\n8. Produce remediation steps: upgrade base image, pin package versions, replace vulnerable dependencies\n9. Integrate scanning into CI\u002FCD pipeline: fail builds on Critical\u002FHigh vulnerabilities, generate SARIF output for GitHub Security tab\n\n## Output\n\n- Vulnerability scan report in JSON, table, or SARIF format\n- Hadolint report with Dockerfile improvement recommendations\n- Remediation Dockerfile patches (updated base image, pinned package versions)\n- CI\u002FCD pipeline step configuration for automated image scanning\n- Security policy document defining acceptable risk thresholds\n\n## Error Handling\n\n| Error | Cause | Solution |\n|-------|-------|---------|\n| `trivy: unable to pull image` | Image not found locally or registry auth failure | Pull image first with `docker pull` or configure registry credentials |\n| `CRITICAL vulnerability found but no fix available` | Upstream package has no patch yet | Document as accepted risk, use `--ignore-unfixed` flag, or switch to an alternative base image |\n| `hadolint: DL3008 pin versions in apt-get install` | Packages installed without version pinning | Add version pins (e.g., `apt-get install nginx=1.24.0-1`) or use `--no-install-recommends` |\n| `Scan timeout on large image` | Image has many layers or large filesystem | Use `--timeout 15m` flag; scan a specific layer or use `--skip-dirs` to exclude test data |\n| `False positive CVE` | Scanner database maps CVE to a package not actually exploitable | Add to `.trivyignore` or Grype ignore file with justification comment |\n\n## Examples\n\n- \"Scan all production Docker images for Critical and High CVEs, generate a report, and create Jira tickets for each finding.\"\n- \"Lint the Dockerfile for best practices: ensure multi-stage build, non-root USER, no ADD for remote URLs, and pinned base image digest.\"\n- \"Set up a GitHub Actions step that runs Trivy on every PR, fails on Critical vulnerabilities, and uploads results to the Security tab via SARIF.\"\n\n## Resources\n\n- Trivy: https:\u002F\u002Faquasecurity.github.io\u002Ftrivy\u002F\n- Grype: https:\u002F\u002Fgithub.com\u002Fanchore\u002Fgrype\n- Hadolint: https:\u002F\u002Fgithub.com\u002Fhadolint\u002Fhadolint\n- Docker Scout: https:\u002F\u002Fdocs.docker.com\u002Fscout\u002F\n- CIS Docker Benchmark: https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fdocker","# Scanning Container Security\n\n## Overview\n\nScan container images and Dockerfiles for vulnerabilities, misconfigurations, and compliance violations using Trivy, Grype, Snyk Container, and Hadolint. Analyze base images, OS packages, application dependencies, and runtime configurations to produce actionable security reports with remediation guidance.\n\n## Prerequisites\n\n- Container scanning tool installed: `trivy`, `grype`, `snyk`, or `docker scout`\n- Dockerfile linter: `hadolint` for Dockerfile best practice validation\n- Docker daemon running for local image scanning\n- Access to the container images to scan (local, registry, or tar archive)\n- `jq` for parsing JSON scan results\n\n## Instructions\n\n1. Identify target images for scanning: production images, base images, and CI-built images\n2. Lint Dockerfiles with `hadolint Dockerfile` to catch misconfigurations before build (privileged instructions, pinned versions, shell best practices)\n3. Scan built images for OS-level vulnerabilities: `trivy image \u003Cimage:tag>` or `grype \u003Cimage:tag>`\n4. Scan for application dependency vulnerabilities: check language-specific packages (npm, pip, Maven, Go modules) embedded in the image\n5. Check for secrets accidentally baked into image layers: `trivy image --scanners secret \u003Cimage:tag>`\n6. Evaluate image against CIS Docker Benchmark: verify non-root user, read-only filesystem capability, health checks defined\n7. Generate a security report with severity classification (Critical, High, Medium, Low) and CVE identifiers\n8. Produce remediation steps: upgrade base image, pin package versions, replace vulnerable dependencies\n9. Integrate scanning into CI\u002FCD pipeline: fail builds on Critical\u002FHigh vulnerabilities, generate SARIF output for GitHub Security tab\n\n## Output\n\n- Vulnerability scan report in JSON, table, or SARIF format\n- Hadolint report with Dockerfile improvement recommendations\n- Remediation Dockerfile patches (updated base image, pinned package versions)\n- CI\u002FCD pipeline step configuration for automated image scanning\n- Security policy document defining acceptable risk thresholds\n\n## Error Handling\n\n| Error | Cause | Solution |\n|-------|-------|---------|\n| `trivy: unable to pull image` | Image not found locally or registry auth failure | Pull image first with `docker pull` or configure registry credentials |\n| `CRITICAL vulnerability found but no fix available` | Upstream package has no patch yet | Document as accepted risk, use `--ignore-unfixed` flag, or switch to an alternative base image |\n| `hadolint: DL3008 pin versions in apt-get install` | Packages installed without version pinning | Add version pins (e.g., `apt-get install nginx=1.24.0-1`) or use `--no-install-recommends` |\n| `Scan timeout on large image` | Image has many layers or large filesystem | Use `--timeout 15m` flag; scan a specific layer or use `--skip-dirs` to exclude test data |\n| `False positive CVE` | Scanner database maps CVE to a package not actually exploitable | Add to `.trivyignore` or Grype ignore file with justification comment |\n\n## Examples\n\n- \"Scan all production Docker images for Critical and High CVEs, generate a report, and create Jira tickets for each finding.\"\n- \"Lint the Dockerfile for best practices: ensure multi-stage build, non-root USER, no ADD for remote URLs, and pinned base image digest.\"\n- \"Set up a GitHub Actions step that runs Trivy on every PR, fails on Critical vulnerabilities, and uploads results to the Security tab via SARIF.\"\n\n## Resources\n\n- Trivy: https:\u002F\u002Faquasecurity.github.io\u002Ftrivy\u002F\n- Grype: https:\u002F\u002Fgithub.com\u002Fanchore\u002Fgrype\n- Hadolint: https:\u002F\u002Fgithub.com\u002Fhadolint\u002Fhadolint\n- Docker Scout: https:\u002F\u002Fdocs.docker.com\u002Fscout\u002F\n- CIS Docker Benchmark: https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fdocker",{"name":5,"author":43,"license":14,"version":44,"description":45,"allowed-tools":46,"compatible-with":47},"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Execute use when you need to work with security and compliance.\nThis skill provides security scanning and vulnerability detection with comprehensive guidance and automation.\nTrigger with phrases like \"scan for vulnerabilities\", \"implement security controls\",\nor \"audit security\".\n","Read, Write, Edit, Grep, Glob, Bash(docker:*), Bash(kubectl:*)","claude-code, codex, openclaw","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","claude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fdevops\u002Fcontainer-security-scanner\u002Fskills\u002Fscanning-container-security",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add micsapp\u002Fmicstec-skills --skill scanning-container-security",{"tool":61,"command":62},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill scanning-container-security",{"tool":64,"command":65},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill scanning-container-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fdevops\u002Fcontainer-security-scanner\u002Fskills\u002Fscanning-container-security\u002FSKILL.md",true,[69,75,81,87,91],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"assets\u002FREADME.md","ASSET","资产文件",66,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fdevops\u002Fcontainer-security-scanner\u002Fskills\u002Fscanning-container-security\u002Fassets\u002FREADME.md",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002FREADME.md","REFERENCE","参考文档",70,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fdevops\u002Fcontainer-security-scanner\u002Fskills\u002Fscanning-container-security\u002Freferences\u002FREADME.md",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"scripts\u002FREADME.md","SCRIPT","脚本",460,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fdevops\u002Fcontainer-security-scanner\u002Fskills\u002Fscanning-container-security\u002Fscripts\u002FREADME.md",{"path":88,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":89,"sourceHtmlUrl":90},"scripts\u002Fsnyk_scan.sh",2909,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fdevops\u002Fcontainer-security-scanner\u002Fskills\u002Fscanning-container-security\u002Fscripts\u002Fsnyk_scan.sh",{"path":92,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":93,"sourceHtmlUrl":94},"scripts\u002Ftrivy_scan.sh",2913,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fdevops\u002Fcontainer-security-scanner\u002Fskills\u002Fscanning-container-security\u002Fscripts\u002Ftrivy_scan.sh",[96,132,161,180,200,225],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":112,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[102,107],{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":108,"categoryName":109,"taxonomyType":110,"taxonomyTypeDesc":111},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,37],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":146,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[138,139,142,145],{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},{"categoryNo":140,"categoryName":141,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":143,"categoryName":144,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":108,"categoryName":109,"taxonomyType":110,"taxonomyTypeDesc":111},[147,148,149,150,114,151,26,152,153,154,155,156,122,123,129,157,158,130,159,160],"deployment","apiops deployment","workflows","azure devops","infrastructure","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[167],{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},[169,170,171,18,114,117,122,123,172,25,173,174,175,176,177,130,178,179,160,37],"policy","authoring","apim policy authoring","access","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":188,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[186,187],{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},{"categoryNo":108,"categoryName":109,"taxonomyType":110,"taxonomyTypeDesc":111},[189,18,190,122,174,191,114,147,192,193,194,195,123,196,130,197,198,199,131,37],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":206,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[207,208,209,149,210,211,212,213,122,214,215,216,217,218,219,220,221,222,223,224],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":231,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[227,232,233,234,235,236,237,25,238,239],"npm","js","calculate","node","math","user","compute","errors"]