[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CGE0TJ1JDP2SAJPX2WVG5":3,"skill-same:01M71CGE0TJ1JDP2SAJPX2WVG5":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":14,"repositoryHtmlUrl":65,"repositoryHomepageUrl":6,"ownerHtmlUrl":66,"ownerBlogUrl":6,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M71CGE0TJ1JDP2SAJPX2WVG5","containers-scanning-grype-respond",null,"Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fscanning\u002Fgrype\u002Frespond\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"scanning","grype","containers","containers scanning grype respond","respond","sonnet","supply-chain","security","SBOM","read","container-security","de","vulnerability-scanning","vulnerability","Bash","cybersecurity","t1195","cm","chain","images","2026-11-10 10:12:30",false,"---\nname: containers-scanning-grype-respond\ndescription: Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- grype\n- vulnerability-scanning\n- container-security\n- sbom\n- anchore\n- supply-chain\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1046\n- T1195\n- T1610\ncapec: []\n---\n\n# Scanning Container Images with Grype\n\n## Overview\n\nGrype is an open-source vulnerability scanner from Anchore that inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases including NVD, GitHub Advisories, and OS-specific feeds.\n\n\n## When to Use\n\n- When conducting security assessments that involve scanning container images with grype\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Docker or Podman installed\n- Grype CLI installed (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin`)\n- Syft CLI (optional, for SBOM generation)\n- Network access to pull vulnerability databases\n\n## Core Commands\n\n### Install Grype\n\n```bash\n# Install via script\ncurl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n\n# Verify installation\ngrype version\n\n# Install via Homebrew (macOS\u002FLinux)\nbrew install grype\n```\n\n### Scan Container Images\n\n```bash\n# Scan a Docker Hub image\ngrype nginx:latest\n\n# Scan from Docker daemon\ngrype docker:myapp:1.0\n\n# Scan a local archive\ngrype docker-archive:image.tar\n\n# Scan an OCI directory\ngrype oci-dir:path\u002Fto\u002Foci\u002F\n\n# Scan a Singularity image\ngrype sif:image.sif\n\n# Scan a local directory \u002F filesystem\ngrype dir:\u002Fpath\u002Fto\u002Fproject\n```\n\n### Output Formats\n\n```bash\n# Default table output\ngrype alpine:3.18\n\n# JSON output for pipeline processing\ngrype alpine:3.18 -o json > results.json\n\n# CycloneDX SBOM output\ngrype alpine:3.18 -o cyclonedx\n\n# SARIF output for GitHub Security tab\ngrype alpine:3.18 -o sarif > grype.sarif\n\n# Template-based custom output\ngrype alpine:3.18 -o template -t \u002Fpath\u002Fto\u002Ftemplate.tmpl\n```\n\n### Filtering and Thresholds\n\n```bash\n# Fail if vulnerabilities meet or exceed a severity\ngrype nginx:latest --fail-on critical\n\n# Show only fixed vulnerabilities\ngrype nginx:latest --only-fixed\n\n# Show only non-fixed vulnerabilities\ngrype nginx:latest --only-notfixed\n\n# Filter by severity\ngrype nginx:latest --only-fixed -o json | jq '[.matches[] | select(.vulnerability.severity == \"High\")]'\n\n# Explain a specific CVE\ngrype nginx:latest --explain --id CVE-2024-1234\n```\n\n### Working with SBOMs\n\n```bash\n# Generate SBOM with Syft then scan\nsyft nginx:latest -o spdx-json > nginx-sbom.json\ngrype sbom:nginx-sbom.json\n\n# Scan CycloneDX SBOM\ngrype sbom:bom.json\n```\n\n### Configuration File (.grype.yaml)\n\n```yaml\n# .grype.yaml\ncheck-for-app-update: false\nfail-on-severity: \"high\"\noutput: \"json\"\nscope: \"squashed\"  # or \"all-layers\"\nquiet: false\n\nignore:\n  - vulnerability: CVE-2023-12345\n    reason: \"False positive - not exploitable in our context\"\n  - vulnerability: CVE-2023-67890\n    fix-state: unknown\n\ndb:\n  auto-update: true\n  cache-dir: \"\u002Ftmp\u002Fgrype-db\"\n  max-allowed-built-age: 120h  # 5 days\n\nmatch:\n  java:\n    using-cpes: true\n  python:\n    using-cpes: true\n  javascript:\n    using-cpes: false\n```\n\n### CI\u002FCD Integration\n\n```yaml\n# GitHub Actions\n- name: Scan image with Grype\n  uses: anchore\u002Fscan-action@v4\n  with:\n    image: \"myregistry\u002Fmyapp:${{ github.sha }}\"\n    fail-build: true\n    severity-cutoff: high\n    output-format: sarif\n  id: scan\n\n- name: Upload SARIF\n  uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n  with:\n    sarif_file: ${{ steps.scan.outputs.sarif }}\n```\n\n```yaml\n# GitLab CI\ncontainer_scan:\n  stage: test\n  image: anchore\u002Fgrype:latest\n  script:\n    - grype ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA} --fail-on high -o json > grype-report.json\n  artifacts:\n    reports:\n      container_scanning: grype-report.json\n```\n\n## Database Management\n\n```bash\n# Check database status\ngrype db status\n\n# Manually update vulnerability database\ngrype db update\n\n# Delete cached database\ngrype db delete\n\n# List supported database providers\ngrype db list\n```\n\n## Key Vulnerability Sources\n\n| Source | Coverage |\n|--------|----------|\n| NVD | CVEs across all ecosystems |\n| GitHub Advisories | Open source package vulnerabilities |\n| Alpine SecDB | Alpine Linux packages |\n| Amazon Linux ALAS | Amazon Linux AMI |\n| Debian Security Tracker | Debian packages |\n| Red Hat OVAL | RHEL, CentOS |\n| Ubuntu Security | Ubuntu packages |\n| Wolfi SecDB | Wolfi\u002FChainguard images |\n\n## Best Practices\n\n1. **Pin image tags** - Always scan specific digests, not `latest`\n2. **Fail on severity** - Set `--fail-on high` or `critical` in CI gates\n3. **Use SBOMs** - Generate SBOMs with Syft for reproducible scanning\n4. **Suppress false positives** - Use `.grype.yaml` ignore rules with documented reasons\n5. **Scan all layers** - Use `--scope all-layers` to catch vulnerabilities in intermediate layers\n6. **Automate database updates** - Keep the vulnerability database current in CI runners\n7. **Compare scans** - Track vulnerability count over time for regression detection\n","# Scanning Container Images with Grype\n\n## Overview\n\nGrype is an open-source vulnerability scanner from Anchore that inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases including NVD, GitHub Advisories, and OS-specific feeds.\n\n\n## When to Use\n\n- When conducting security assessments that involve scanning container images with grype\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Docker or Podman installed\n- Grype CLI installed (`curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin`)\n- Syft CLI (optional, for SBOM generation)\n- Network access to pull vulnerability databases\n\n## Core Commands\n\n### Install Grype\n\n```bash\n# Install via script\ncurl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n\n# Verify installation\ngrype version\n\n# Install via Homebrew (macOS\u002FLinux)\nbrew install grype\n```\n\n### Scan Container Images\n\n```bash\n# Scan a Docker Hub image\ngrype nginx:latest\n\n# Scan from Docker daemon\ngrype docker:myapp:1.0\n\n# Scan a local archive\ngrype docker-archive:image.tar\n\n# Scan an OCI directory\ngrype oci-dir:path\u002Fto\u002Foci\u002F\n\n# Scan a Singularity image\ngrype sif:image.sif\n\n# Scan a local directory \u002F filesystem\ngrype dir:\u002Fpath\u002Fto\u002Fproject\n```\n\n### Output Formats\n\n```bash\n# Default table output\ngrype alpine:3.18\n\n# JSON output for pipeline processing\ngrype alpine:3.18 -o json > results.json\n\n# CycloneDX SBOM output\ngrype alpine:3.18 -o cyclonedx\n\n# SARIF output for GitHub Security tab\ngrype alpine:3.18 -o sarif > grype.sarif\n\n# Template-based custom output\ngrype alpine:3.18 -o template -t \u002Fpath\u002Fto\u002Ftemplate.tmpl\n```\n\n### Filtering and Thresholds\n\n```bash\n# Fail if vulnerabilities meet or exceed a severity\ngrype nginx:latest --fail-on critical\n\n# Show only fixed vulnerabilities\ngrype nginx:latest --only-fixed\n\n# Show only non-fixed vulnerabilities\ngrype nginx:latest --only-notfixed\n\n# Filter by severity\ngrype nginx:latest --only-fixed -o json | jq '[.matches[] | select(.vulnerability.severity == \"High\")]'\n\n# Explain a specific CVE\ngrype nginx:latest --explain --id CVE-2024-1234\n```\n\n### Working with SBOMs\n\n```bash\n# Generate SBOM with Syft then scan\nsyft nginx:latest -o spdx-json > nginx-sbom.json\ngrype sbom:nginx-sbom.json\n\n# Scan CycloneDX SBOM\ngrype sbom:bom.json\n```\n\n### Configuration File (.grype.yaml)\n\n```yaml\n# .grype.yaml\ncheck-for-app-update: false\nfail-on-severity: \"high\"\noutput: \"json\"\nscope: \"squashed\"  # or \"all-layers\"\nquiet: false\n\nignore:\n  - vulnerability: CVE-2023-12345\n    reason: \"False positive - not exploitable in our context\"\n  - vulnerability: CVE-2023-67890\n    fix-state: unknown\n\ndb:\n  auto-update: true\n  cache-dir: \"\u002Ftmp\u002Fgrype-db\"\n  max-allowed-built-age: 120h  # 5 days\n\nmatch:\n  java:\n    using-cpes: true\n  python:\n    using-cpes: true\n  javascript:\n    using-cpes: false\n```\n\n### CI\u002FCD Integration\n\n```yaml\n# GitHub Actions\n- name: Scan image with Grype\n  uses: anchore\u002Fscan-action@v4\n  with:\n    image: \"myregistry\u002Fmyapp:${{ github.sha }}\"\n    fail-build: true\n    severity-cutoff: high\n    output-format: sarif\n  id: scan\n\n- name: Upload SARIF\n  uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n  with:\n    sarif_file: ${{ steps.scan.outputs.sarif }}\n```\n\n```yaml\n# GitLab CI\ncontainer_scan:\n  stage: test\n  image: anchore\u002Fgrype:latest\n  script:\n    - grype ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA} --fail-on high -o json > grype-report.json\n  artifacts:\n    reports:\n      container_scanning: grype-report.json\n```\n\n## Database Management\n\n```bash\n# Check database status\ngrype db status\n\n# Manually update vulnerability database\ngrype db update\n\n# Delete cached database\ngrype db delete\n\n# List supported database providers\ngrype db list\n```\n\n## Key Vulnerability Sources\n\n| Source | Coverage |\n|--------|----------|\n| NVD | CVEs across all ecosystems |\n| GitHub Advisories | Open source package vulnerabilities |\n| Alpine SecDB | Alpine Linux packages |\n| Amazon Linux ALAS | Amazon Linux AMI |\n| Debian Security Tracker | Debian packages |\n| Red Hat OVAL | RHEL, CentOS |\n| Ubuntu Security | Ubuntu packages |\n| Wolfi SecDB | Wolfi\u002FChainguard images |\n\n## Best Practices\n\n1. **Pin image tags** - Always scan specific digests, not `latest`\n2. **Fail on severity** - Set `--fail-on high` or `critical` in CI gates\n3. **Use SBOMs** - Generate SBOMs with Syft for reproducible scanning\n4. **Suppress false positives** - Use `.grype.yaml` ignore rules with documented reasons\n5. **Scan all layers** - Use `--scope all-layers` to catch vulnerabilities in intermediate layers\n6. **Automate database updates** - Keep the vulnerability database current in CI runners\n7. **Compare scans** - Track vulnerability count over time for regression detection\n",{"name":5,"tags":44,"capec":47,"model":24,"tools":48,"domain":34,"maxTurns":52,"nist_csf":53,"subdomain":29,"description":7,"mitre_attack":58},[20,31,29,45,46,25],"sbom","anchore",[],[49,33,50,51],"Read","Glob","Grep",20,[54,55,56,57],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[59,60,61],"T1046","T1195","T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fcontainers\u002Fscanning\u002Fgrype\u002Frespond","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill containers-scanning-grype-respond",{"tool":75,"command":76},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill containers-scanning-grype-respond",{"tool":78,"command":79},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill containers-scanning-grype-respond","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fscanning\u002Fgrype\u002Frespond\u002FSKILL.md",true,[83],{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"index.json","REFERENCE","参考文档",640,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fscanning\u002Fgrype\u002Frespond\u002Findex.json",[90,113,134,155,177,193],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[97,98,99,100,101,30,36,102,103,104,105,106,107,108,109,110,111,34,112],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[120,97,121,100,122,123,124,34,33,125,126,127,128,129,30,130,131,28,132,133],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[141,142,143,144,145,146,34,33,147,125,148,149,30,28,150,151,152,153,154,24],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[98,162,163,164,165,166,167,36,168,34,112,169,170,171,172,173,174,175,176,30],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[184,185,98,186,164,166,187,36,188,168,34,112,125,189,190,191,192,176,30,102],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":199,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[200,98,164,201,187,36,202,203,34,112,204,205,206,207,208,209,30,102,210,211],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]