/sca-trivy

name: sca-trivy
description: >
  Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy
  for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations,
  and license compliance risks. Use when: (1) Scanning container images and filesystems for
  vulnerabilities and misconfigurations, (2) Analyzing dependencies for known CVEs across
  multiple languages (Go, Python, Node.js, Java, etc.), (3) Detecting IaC security issues
  in Terraform, Kubernetes, Dockerfile, (4) Integrating vulnerability scanning into CI/CD
  pipelines with SARIF output, (5) Generating Software Bill of Materials (SBOM) in CycloneDX
  or SPDX format, (6) Prioritizing remediation by CVSS score and exploitability.
version: 0.1.0
maintainer: SirAppSec
category: devsecops
tags: [sca, trivy, container-security, vulnerability-scanning, sbom, iac-security, dependency-scanning, cvss]
frameworks: [OWASP, CWE, NIST, PCI-DSS, SOC2]
dependencies:
  tools: [trivy, docker]
references:
  - https://aquasecurity.github.io/trivy/
  - https://owasp.org/www-project-dependency-check/
  - https://nvd.nist.gov/
  - https://www.cisa.gov/sbom

Software Composition Analysis with Trivy

Overview

Trivy is a comprehensive security scanner for containers, filesystems, and git repositories. It detects vulnerabilities (CVEs) in OS packages and application dependencies, IaC misconfigurations, exposed secrets, and software licenses. This skill provides workflows for vulnerability scanning, SBOM generation, CI/CD integration, and remediation prioritization aligned with CVSS and OWASP standards.

Quick Start

Scan a container image for vulnerabilities:

# Install Trivy
brew install trivy  # macOS
# or: apt-get install trivy  # Debian/Ubuntu
# or: docker pull aquasec/trivy:latest

# Scan container image
trivy image nginx:latest

# Scan local filesystem for dependencies
trivy fs .

# Scan IaC files for misconfigurations
trivy config .

# Generate SBOM
trivy image --format cyclonedx --output sbom.json nginx:latest

Core Workflows

Workflow 1: Container Image Security Assessment

Progress: [ ] 1. Identify target container image (repository:tag) [ ] 2. Run comprehensive Trivy scan with `trivy image <image-name>` [ ] 3. Analyze vulnerability findings by severity (CRITICAL, HIGH, MEDIUM, LOW) [ ] 4. Map CVE findings to CWE categories and OWASP references [ ] 5. Check for available patches and updated base images [ ] 6. Generate prioritized remediation report with upgrade recommendations

Work through each step systematically. Check off completed items.

Workflow 2: Dependency Vulnerability Scanning

Scan project dependencies for known vulnerabilities:

# Scan filesystem for all dependencies
trivy fs --severity CRITICAL,HIGH .

# Scan specific package manifest
trivy fs --scanners vuln package-lock.json

# Generate JSON report for analysis
trivy fs --format json --output trivy-report.json .

# Generate SARIF for GitHub/GitLab integration
trivy fs --format sarif --output trivy.sarif .

For each vulnerability: 1. Review CVE details and CVSS score 2. Check if fixed version is available 3. Consult `references/remediation_guide.md` for language-specific guidance 4. Update dependency to patched version 5. Re-scan to validate fix

Workflow 3: Infrastructure as Code Security

Detect misconfigurations in IaC files:

# Scan Terraform configurations
trivy config ./terraform --severity CRITICAL,HIGH

# Scan Kubernetes manifests
trivy config ./k8s --severity CRITICAL,HIGH

# Scan Dockerfile best practices
trivy config --file-patterns dockerfile:Dockerfile .

# Generate report with remediation guidance
trivy config --format json --output iac-findings.json .

Review findings by category:

• **Security**: Authentication, authorization, encryption
• **Compliance**: CIS benchmarks, security standards
• **Best Practices**: Resource limits, immutability, least privilege

Workflow 4: CI/CD Pipeline Integration

GitHub Actions

name: Trivy Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload results to GitHub Security
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

GitLab CI

trivy-scan:
  stage: test
  image: aquasec/trivy:latest
  script:
    - trivy fs --exit-code 1 --severity CRITICAL,HIGH --format json --output trivy-report.json .
  artifacts:
    reports:
      dependency_scanning: trivy-report.json
    when: always
  allow_failure: false

Use bundled templates from `assets/ci_integration/` for additional platforms.

Workflow 5: SBOM Generation

Generate Software Bill of Materials for supply chain transparency:

# Generate CycloneDX SBOM
trivy image --format cyclonedx --output sbom-cyclonedx.json nginx:latest

# Generate SPDX SBOM
trivy image --format spdx-json --output sbom-spdx.json nginx:latest

# SBOM for filesystem/project
trivy fs --format cyclonedx --output project-sbom.json .

SBOM use cases:

• **Vulnerability tracking**: Monitor dependencies for new CVEs
• **License compliance**: Identify license obligations and risks
• **Supply chain security**: Verify component provenance
• **Regulatory compliance**: Meet CISA SBOM requirements

Security Considerations

Sensitive Data Handling

• **Registry credentials**: Use environment variables or credential helpers, never hardcode
• **Scan reports**: Contain vulnerability details and package versions - treat as sensitive
• **SBOM files**: May reveal internal architecture - control access appropriately
• **Secret scanning**: Enable w