vulnerability-scanning

What it does

This skill enables AI agents to automatically scan codebases and infrastructure for known security vulnerabilities, misconfigurations, and weak cryptographic implementations. It leverages tools like Trivy and Semgrep to provide actionable reports on potential risks before deployment.

When to use it

• Before deploying new containers or images to production environments.
• During the CI/CD pipeline to block builds containing critical CVEs.
• When auditing third-party dependencies for outdated or insecure packages.
• To identify configuration errors in cloud infrastructure-as-code files.

Key capabilities

• Scans container images and Dockerfiles for vulnerabilities using Trivy.
• Analyzes codebases for security issues with Semgrep rules.
• Detects weak cryptographic implementations and hardcoded secrets.
• Generates structured reports detailing severity levels and remediation steps.

Example prompts

• "Scan my latest Docker image for any known CVEs and list the high-severity findings."
• "Run a Semgrep analysis on my Python repository to find potential SQL injection vulnerabilities."
• "Check my infrastructure-as-code configuration for misconfigurations that expose sensitive data."

Tips & gotchas

Ensure your AI agent has read access to the relevant repositories or container registries before initiating scans. While this skill identifies known issues, it should be combined with manual code reviews and penetration testing for comprehensive security coverage.