[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71BJ2SDF7JH58XGEGQMS17T":3,"skill-same:01M71BJ2SDF7JH58XGEGQMS17T":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":61,"updatedAt":62,"install":63,"resources":75},"01M71BJ2SDF7JH58XGEGQMS17T","cyber-securing-container-registry-images",null,"Securing container registry images by implementing vulnerability scanning with Trivy and Grype, enforcing image signing with Cosign and Sigstore, configuring registry access controls, and building CI\u002FCD pipelines that prevent deploying unscanned or unsigned images.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-securing-container-registry-images\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"registry","container","cyber securing container registry images","securing container registry images","images","containers","domain","grype","security","CI\u002FCD","cloud-security","scanning","subdomain","vulnerability","image","access","false","cybersecurity","implementing","ci","2026-11-10 10:12:30",false,"---\nname: cyber-securing-container-registry-images\ndescription: \"Securing container registry images by implementing vulnerability scanning with Trivy and Grype, enforcing image signing with Cosign and Sigstore, configuring registry access controls, and building CI\u002FCD pipelines that prevent deploying unscanned or unsigned images.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: securing-container-registry-images | description: 'Securing container registry images by implementing vulnerability scanning |   with Trivy and Grype, enforcing image signing with Cosign and Sigstore, configuring |   registry access controls, and building CI\u002FCD pipelines that prevent deploying unscanned |   or unsigned images. |  |   ' | domain: cybersecurity | subdomain: cloud-security | tags: | - cloud-security | - containers | - registry | - image-scanning | - trivy | - cosign | - suppl\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Securing Container Registry Images\n\n## When to Use\n\n- When establishing security controls for container image registries (ECR, ACR, GCR, Docker Hub)\n- When building CI\u002FCD pipelines that enforce vulnerability scanning before image promotion\n- When implementing image signing and verification to prevent supply chain attacks\n- When auditing existing registries for vulnerable, unscanned, or unsigned images\n- When compliance requires software bill of materials (SBOM) for deployed container images\n\n**Do not use** for runtime container security (use Falco or Sysdig), for Kubernetes admission control (use OPA Gatekeeper or Kyverno after establishing registry controls), or for host-level vulnerability scanning (use Amazon Inspector or Qualys).\n\n## Prerequisites\n\n- Trivy installed (`brew install trivy` or `apt install trivy`)\n- Grype installed (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh`)\n- Cosign installed for image signing (`go install github.com\u002Fsigstore\u002Fcosign\u002Fv2\u002Fcmd\u002Fcosign@latest`)\n- Syft installed for SBOM generation (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fsyft\u002Fmain\u002Finstall.sh | sh`)\n- Container registry access (ECR, ACR, GCR, or private registry)\n\n## Workflow\n\n### Step 1: Scan Images for Vulnerabilities with Trivy\n\nRun comprehensive vulnerability scans against container images before and after pushing to the registry.\n\n```bash\n# Scan a local image for vulnerabilities\ntrivy image --severity HIGH,CRITICAL myapp:latest\n\n# Scan a remote registry image\ntrivy image --severity HIGH,CRITICAL 123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Scan with JSON output for CI\u002FCD processing\ntrivy image --format json --output trivy-results.json myapp:latest\n\n# Scan for vulnerabilities AND misconfigurations\ntrivy image --scanners vuln,misconfig,secret myapp:latest\n\n# Scan a specific image with SBOM output\ntrivy image --format spdx-json --output sbom.json myapp:latest\n\n# Fail CI\u002FCD if critical vulnerabilities found\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\n```\n\n### Step 2: Scan with Grype for Additional Coverage\n\nUse Grype as a complementary scanner for broader vulnerability database coverage.\n\n```bash\n# Scan image with Grype\ngrype myapp:latest\n\n# Scan with severity threshold\ngrype myapp:latest --fail-on critical\n\n# Output in JSON for processing\ngrype myapp:latest -o json > grype-results.json\n\n# Scan an SBOM instead of the image directly\nsyft myapp:latest -o spdx-json > sbom.json\ngrype sbom:sbom.json\n\n# Scan a directory-based image export\ngrype dir:\u002Fpath\u002Fto\u002Fimage-rootfs\n```\n\n### Step 3: Generate Software Bill of Materials (SBOM)\n\nCreate SBOMs for all images to maintain an inventory of software components and dependencies.\n\n```bash\n# Generate SBOM with Syft in SPDX format\nsyft myapp:latest -o spdx-json > sbom-spdx.json\n\n# Generate SBOM in CycloneDX format\nsyft myapp:latest -o cyclonedx-json > sbom-cyclonedx.json\n\n# Attach SBOM to the image as an OCI artifact\ncosign attach sbom --sbom sbom-spdx.json \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify SBOM contents\nsyft myapp:latest -o table | head -50\n```\n\n### Step 4: Sign Images with Cosign and Sigstore\n\nImplement image signing to ensure image integrity and authenticity in the supply chain.\n\n```bash\n# Generate a key pair for signing\ncosign generate-key-pair\n\n# Sign an image in the registry\ncosign sign --key cosign.key \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Sign using keyless signing with Sigstore (OIDC-based)\ncosign sign --yes \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify image signature\ncosign verify --key cosign.pub \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify keyless signature\ncosign verify \\\n  --certificate-identity developer@company.com \\\n  --certificate-oidc-issuer https:\u002F\u002Faccounts.google.com \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Add attestation with scan results\ncosign attest --predicate trivy-results.json \\\n  --key cosign.key \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n```\n\n### Step 5: Configure Registry-Level Security Controls\n\nSet up registry-specific security features for ECR, ACR, and GCR.\n\n```bash\n# AWS ECR: Enable image scanning on push\naws ecr put-image-scanning-configuration \\\n  --repository-name myapp \\\n  --image-scanning-configuration scanOnPush=true\n\n# ECR: Set image tag immutability (prevent tag overwrites)\naws ecr put-image-tag-mutability \\\n  --repository-name myapp \\\n  --image-tag-mutability IMMUTABLE\n\n# ECR: Set lifecycle policy to clean up untagged images\naws ecr put-lifecycle-policy \\\n  --repository-name myapp \\\n  --lifecycle-policy-text '{\n    \"rules\": [{\n      \"rulePriority\": 1,\n      \"description\": \"Remove untagged images after 7 days\",\n      \"selection\": {\"tagStatus\": \"untagged\", \"countType\": \"sinceImagePushed\", \"countUnit\": \"days\", \"countNumber\": 7},\n      \"action\": {\"type\": \"expire\"}\n    }]\n  }'\n\n# ECR: Get scan findings for an image\naws ecr describe-image-scan-findings \\\n  --repository-name myapp \\\n  --image-id imageTag=latest \\\n  --query 'imageScanFindings.findingSeverityCounts'\n\n# Azure ACR: Enable Defender for container registries\naz security pricing create --name ContainerRegistry --tier standard\n\n# GCR: Enable Container Analysis\ngcloud services enable containeranalysis.googleapis.com\ngcloud artifacts docker images list-vulnerabilities \\\n  LOCATION-docker.pkg.dev\u002FPROJECT\u002FREPO\u002FIMAGE@sha256:DIGEST\n```\n\n### Step 6: Build CI\u002FCD Pipeline with Security Gates\n\nIntegrate scanning and signing into the CI\u002FCD pipeline as mandatory gates.\n\n```yaml\n# GitHub Actions: Scan, sign, and push image\nname: Container Security Pipeline\non: push\n\njobs:\n  build-scan-sign:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Trivy vulnerability scan\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: json\n          output: trivy-results.json\n          severity: CRITICAL,HIGH\n          exit-code: 1\n\n      - name: Generate SBOM\n        run: syft myapp:${{ github.sha }} -o spdx-json > sbom.json\n\n      - name: Push to ECR\n        run: |\n          aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_REGISTRY\n          docker tag myapp:${{ github.sha }} $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n          docker push $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n\n      - name: Sign image with Cosign\n        run: |\n          cosign sign --key env:\u002F\u002FCOSIGN_PRIVATE_KEY \\\n            $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n\n      - name: Attach SBOM\n        run: |\n          cosign attach sbom --sbom sbom.json \\\n            $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Container Image Scanning | Automated analysis of container image layers to identify known vulnerabilities in OS packages and application dependencies |\n| Image Signing | Cryptographic attestation that verifies the authenticity and integrity of a container image using Cosign or Notation |\n| SBOM | Software Bill of Materials, a comprehensive inventory of software components, libraries, and dependencies in a container image |\n| Tag Immutability | Registry setting that prevents overwriting existing image tags, ensuring that a tag always refers to the same image digest |\n| Sigstore | Open-source project providing keyless signing, transparency logs, and verification tooling for software supply chain security |\n| Image Attestation | Cryptographically signed metadata attached to an image (scan results, SBOM, build provenance) that can be verified before deployment |\n\n## Tools & Systems\n\n- **Trivy**: Comprehensive vulnerability scanner for container images, filesystems, git repos, and Kubernetes resources\n- **Grype**: Anchore's vulnerability scanner with broad vulnerability database coverage for container images and SBOMs\n- **Cosign**: Sigstore tool for signing, verifying, and attesting container images with key-based or keyless workflows\n- **Syft**: SBOM generation tool supporting SPDX and CycloneDX formats for container images and filesystems\n- **AWS ECR**: Container registry with built-in scanning, tag immutability, and lifecycle policies\n\n## Common Scenarios\n\n### Scenario: Implementing a Secure Image Promotion Pipeline\n\n**Context**: A development team pushes images to a dev registry without security controls. The security team needs to implement a promotion pipeline that scans, signs, and promotes only approved images to the production registry.\n\n**Approach**:\n1. Configure ECR scanning on push for the development repository\n2. Add Trivy scanning as a CI\u002FCD gate that blocks images with CRITICAL vulnerabilities\n3. Generate SBOMs with Syft and store alongside image scan results\n4. Sign approved images with Cosign after scanning passes\n5. Configure the production registry to require image signatures for all pushes\n6. Set up Kyverno or OPA Gatekeeper in production Kubernetes to verify signatures before pod creation\n7. Implement lifecycle policies to clean up untagged and old images in both registries\n\n**Pitfalls**: Vulnerability databases are updated constantly. An image that passes scanning today may have new CRITICAL vulnerabilities discovered tomorrow. Implement continuous scanning of already-deployed images, not just at build time. Image signing keys must be securely stored in KMS or Vault, not in CI\u002FCD environment variables.\n\n## Output Format\n\n```\nContainer Registry Security Report\n=====================================\nRegistry: 123456789012.dkr.ecr.us-east-1.amazonaws.com\nRepositories: 24\nReport Date: 2026-02-23\n\nIMAGE INVENTORY:\n  Total images: 342\n  Images scanned: 298 (87%)\n  Images signed: 156 (46%)\n  Images with SBOM: 134 (39%)\n\nVULNERABILITY SUMMARY:\n  Critical vulnerabilities:    23 (across 8 images)\n  High vulnerabilities:       145 (across 34 images)\n  Medium vulnerabilities:     456 (across 67 images)\n  Images with no vulns:       89\n\nCRITICAL IMAGES REQUIRING REMEDIATION:\n  myapp:1.2.3           - 5 CRITICAL (CVE-2026-xxxx in openssl)\n  api-gateway:2.0.1     - 3 CRITICAL (CVE-2026-yyyy in log4j)\n  worker:latest         - 4 CRITICAL (CVE-2026-zzzz in glibc)\n\nREGISTRY CONFIGURATION:\n  Scan on push enabled:     18 \u002F 24 repositories\n  Tag immutability:         12 \u002F 24 repositories\n  Lifecycle policies:       20 \u002F 24 repositories\n  Image signing enforced:    8 \u002F 24 repositories\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Securing Container Registry Images\n\n## When to Use\n\n- When establishing security controls for container image registries (ECR, ACR, GCR, Docker Hub)\n- When building CI\u002FCD pipelines that enforce vulnerability scanning before image promotion\n- When implementing image signing and verification to prevent supply chain attacks\n- When auditing existing registries for vulnerable, unscanned, or unsigned images\n- When compliance requires software bill of materials (SBOM) for deployed container images\n\n**Do not use** for runtime container security (use Falco or Sysdig), for Kubernetes admission control (use OPA Gatekeeper or Kyverno after establishing registry controls), or for host-level vulnerability scanning (use Amazon Inspector or Qualys).\n\n## Prerequisites\n\n- Trivy installed (`brew install trivy` or `apt install trivy`)\n- Grype installed (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh`)\n- Cosign installed for image signing (`go install github.com\u002Fsigstore\u002Fcosign\u002Fv2\u002Fcmd\u002Fcosign@latest`)\n- Syft installed for SBOM generation (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fsyft\u002Fmain\u002Finstall.sh | sh`)\n- Container registry access (ECR, ACR, GCR, or private registry)\n\n## Workflow\n\n### Step 1: Scan Images for Vulnerabilities with Trivy\n\nRun comprehensive vulnerability scans against container images before and after pushing to the registry.\n\n```bash\n# Scan a local image for vulnerabilities\ntrivy image --severity HIGH,CRITICAL myapp:latest\n\n# Scan a remote registry image\ntrivy image --severity HIGH,CRITICAL 123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Scan with JSON output for CI\u002FCD processing\ntrivy image --format json --output trivy-results.json myapp:latest\n\n# Scan for vulnerabilities AND misconfigurations\ntrivy image --scanners vuln,misconfig,secret myapp:latest\n\n# Scan a specific image with SBOM output\ntrivy image --format spdx-json --output sbom.json myapp:latest\n\n# Fail CI\u002FCD if critical vulnerabilities found\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\n```\n\n### Step 2: Scan with Grype for Additional Coverage\n\nUse Grype as a complementary scanner for broader vulnerability database coverage.\n\n```bash\n# Scan image with Grype\ngrype myapp:latest\n\n# Scan with severity threshold\ngrype myapp:latest --fail-on critical\n\n# Output in JSON for processing\ngrype myapp:latest -o json > grype-results.json\n\n# Scan an SBOM instead of the image directly\nsyft myapp:latest -o spdx-json > sbom.json\ngrype sbom:sbom.json\n\n# Scan a directory-based image export\ngrype dir:\u002Fpath\u002Fto\u002Fimage-rootfs\n```\n\n### Step 3: Generate Software Bill of Materials (SBOM)\n\nCreate SBOMs for all images to maintain an inventory of software components and dependencies.\n\n```bash\n# Generate SBOM with Syft in SPDX format\nsyft myapp:latest -o spdx-json > sbom-spdx.json\n\n# Generate SBOM in CycloneDX format\nsyft myapp:latest -o cyclonedx-json > sbom-cyclonedx.json\n\n# Attach SBOM to the image as an OCI artifact\ncosign attach sbom --sbom sbom-spdx.json \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify SBOM contents\nsyft myapp:latest -o table | head -50\n```\n\n### Step 4: Sign Images with Cosign and Sigstore\n\nImplement image signing to ensure image integrity and authenticity in the supply chain.\n\n```bash\n# Generate a key pair for signing\ncosign generate-key-pair\n\n# Sign an image in the registry\ncosign sign --key cosign.key \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Sign using keyless signing with Sigstore (OIDC-based)\ncosign sign --yes \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify image signature\ncosign verify --key cosign.pub \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Verify keyless signature\ncosign verify \\\n  --certificate-identity developer@company.com \\\n  --certificate-oidc-issuer https:\u002F\u002Faccounts.google.com \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# Add attestation with scan results\ncosign attest --predicate trivy-results.json \\\n  --key cosign.key \\\n  123456789012.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n```\n\n### Step 5: Configure Registry-Level Security Controls\n\nSet up registry-specific security features for ECR, ACR, and GCR.\n\n```bash\n# AWS ECR: Enable image scanning on push\naws ecr put-image-scanning-configuration \\\n  --repository-name myapp \\\n  --image-scanning-configuration scanOnPush=true\n\n# ECR: Set image tag immutability (prevent tag overwrites)\naws ecr put-image-tag-mutability \\\n  --repository-name myapp \\\n  --image-tag-mutability IMMUTABLE\n\n# ECR: Set lifecycle policy to clean up untagged images\naws ecr put-lifecycle-policy \\\n  --repository-name myapp \\\n  --lifecycle-policy-text '{\n    \"rules\": [{\n      \"rulePriority\": 1,\n      \"description\": \"Remove untagged images after 7 days\",\n      \"selection\": {\"tagStatus\": \"untagged\", \"countType\": \"sinceImagePushed\", \"countUnit\": \"days\", \"countNumber\": 7},\n      \"action\": {\"type\": \"expire\"}\n    }]\n  }'\n\n# ECR: Get scan findings for an image\naws ecr describe-image-scan-findings \\\n  --repository-name myapp \\\n  --image-id imageTag=latest \\\n  --query 'imageScanFindings.findingSeverityCounts'\n\n# Azure ACR: Enable Defender for container registries\naz security pricing create --name ContainerRegistry --tier standard\n\n# GCR: Enable Container Analysis\ngcloud services enable containeranalysis.googleapis.com\ngcloud artifacts docker images list-vulnerabilities \\\n  LOCATION-docker.pkg.dev\u002FPROJECT\u002FREPO\u002FIMAGE@sha256:DIGEST\n```\n\n### Step 6: Build CI\u002FCD Pipeline with Security Gates\n\nIntegrate scanning and signing into the CI\u002FCD pipeline as mandatory gates.\n\n```yaml\n# GitHub Actions: Scan, sign, and push image\nname: Container Security Pipeline\non: push\n\njobs:\n  build-scan-sign:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Trivy vulnerability scan\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: json\n          output: trivy-results.json\n          severity: CRITICAL,HIGH\n          exit-code: 1\n\n      - name: Generate SBOM\n        run: syft myapp:${{ github.sha }} -o spdx-json > sbom.json\n\n      - name: Push to ECR\n        run: |\n          aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_REGISTRY\n          docker tag myapp:${{ github.sha }} $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n          docker push $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n\n      - name: Sign image with Cosign\n        run: |\n          cosign sign --key env:\u002F\u002FCOSIGN_PRIVATE_KEY \\\n            $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n\n      - name: Attach SBOM\n        run: |\n          cosign attach sbom --sbom sbom.json \\\n            $ECR_REGISTRY\u002Fmyapp:${{ github.sha }}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Container Image Scanning | Automated analysis of container image layers to identify known vulnerabilities in OS packages and application dependencies |\n| Image Signing | Cryptographic attestation that verifies the authenticity and integrity of a container image using Cosign or Notation |\n| SBOM | Software Bill of Materials, a comprehensive inventory of software components, libraries, and dependencies in a container image |\n| Tag Immutability | Registry setting that prevents overwriting existing image tags, ensuring that a tag always refers to the same image digest |\n| Sigstore | Open-source project providing keyless signing, transparency logs, and verification tooling for software supply chain security |\n| Image Attestation | Cryptographically signed metadata attached to an image (scan results, SBOM, build provenance) that can be verified before deployment |\n\n## Tools & Systems\n\n- **Trivy**: Comprehensive vulnerability scanner for container images, filesystems, git repos, and Kubernetes resources\n- **Grype**: Anchore's vulnerability scanner with broad vulnerability database coverage for container images and SBOMs\n- **Cosign**: Sigstore tool for signing, verifying, and attesting container images with key-based or keyless workflows\n- **Syft**: SBOM generation tool supporting SPDX and CycloneDX formats for container images and filesystems\n- **AWS ECR**: Container registry with built-in scanning, tag immutability, and lifecycle policies\n\n## Common Scenarios\n\n### Scenario: Implementing a Secure Image Promotion Pipeline\n\n**Context**: A development team pushes images to a dev registry without security controls. The security team needs to implement a promotion pipeline that scans, signs, and promotes only approved images to the production registry.\n\n**Approach**:\n1. Configure ECR scanning on push for the development repository\n2. Add Trivy scanning as a CI\u002FCD gate that blocks images with CRITICAL vulnerabilities\n3. Generate SBOMs with Syft and store alongside image scan results\n4. Sign approved images with Cosign after scanning passes\n5. Configure the production registry to require image signatures for all pushes\n6. Set up Kyverno or OPA Gatekeeper in production Kubernetes to verify signatures before pod creation\n7. Implement lifecycle policies to clean up untagged and old images in both registries\n\n**Pitfalls**: Vulnerability databases are updated constantly. An image that passes scanning today may have new CRITICAL vulnerabilities discovered tomorrow. Implement continuous scanning of already-deployed images, not just at build time. Image signing keys must be securely stored in KMS or Vault, not in CI\u002FCD environment variables.\n\n## Output Format\n\n```\nContainer Registry Security Report\n=====================================\nRegistry: 123456789012.dkr.ecr.us-east-1.amazonaws.com\nRepositories: 24\nReport Date: 2026-02-23\n\nIMAGE INVENTORY:\n  Total images: 342\n  Images scanned: 298 (87%)\n  Images signed: 156 (46%)\n  Images with SBOM: 134 (39%)\n\nVULNERABILITY SUMMARY:\n  Critical vulnerabilities:    23 (across 8 images)\n  High vulnerabilities:       145 (across 34 images)\n  Medium vulnerabilities:     456 (across 67 images)\n  Images with no vulns:       89\n\nCRITICAL IMAGES REQUIRING REMEDIATION:\n  myapp:1.2.3           - 5 CRITICAL (CVE-2026-xxxx in openssl)\n  api-gateway:2.0.1     - 3 CRITICAL (CVE-2026-yyyy in log4j)\n  worker:latest         - 4 CRITICAL (CVE-2026-zzzz in glibc)\n\nREGISTRY CONFIGURATION:\n  Scan on push enabled:     18 \u002F 24 repositories\n  Tag immutability:         12 \u002F 24 repositories\n  Lifecycle policies:       20 \u002F 24 repositories\n  Image signing enforced:    8 \u002F 24 repositories\n```\n",{"hide":52,"name":5,"source":53,"license":15,"description":7,"authorized_lab":48,"origin_frontmatter":54},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: securing-container-registry-images | description: 'Securing container registry images by implementing vulnerability scanning |   with Trivy and Grype, enforcing image signing with Cosign and Sigstore, configuring |   registry access controls, and building CI\u002FCD pipelines that prevent deploying unscanned |   or unsigned images. |  |   ' | domain: cybersecurity | subdomain: cloud-security | tags: | - cloud-security | - containers | - registry | - image-scanning | - trivy | - cosign | - suppl","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-securing-container-registry-images",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":52},[65,68,71],{"tool":66,"command":67},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-securing-container-registry-images",{"tool":69,"command":70},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-securing-container-registry-images",{"tool":72,"command":73},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-securing-container-registry-images","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-securing-container-registry-images\u002FSKILL.md",[],[77,101,125,153,182,201],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":47},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":47},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[108,109,88,110,111,112,113,114,115,116,117,94,118,96,119,120,121,122,123,124],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":134,"publishedAt":47},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[131],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[135,136,137,138,139,140,141,142,143,96,144,145,146,147,148,149,150,112,151,152],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":167,"publishedAt":47},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[159,162],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":163,"categoryName":164,"taxonomyType":165,"taxonomyTypeDesc":166},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[168,98,169,135,88,170,171,172,112,173,174,175,176,177,178,179,180,181,94,96],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":47},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[189,190,191,192,193,194,195,196,197,96,198,119,199,200],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":219,"publishedAt":47},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[207,210,213,216],{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":211,"categoryName":212,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":214,"categoryName":215,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":217,"categoryName":218,"taxonomyType":165,"taxonomyTypeDesc":166},"01JBSEEDCAT000000000000036","内容创作者",[220,221,222,96,119,223,88,224,113,94,225],"writing","writing skills","new","work","editing","Existing"]