CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/grype-scanning

Scans for vulnerabilities using Anchore Grype: `grype sbom:./sbom.json` / `grype {image}` / `grype dir:./` across OS-package + language-package ecosystems (Alpine / Debian / Ubuntu / RHEL / Amazon Linux / Ruby / Java / JavaScript / Python / .NET / Go / PHP / Rust). `.grype.yaml` per-CVE and per-package ignore rules with mandatory `expires:` dates and reachability justification (the Grype-native suppression path, distinct from standalone VEX document authoring in vex-author); EPSS + KEV + risk-score prioritization; OpenVEX assertion filtering; `--fail-on high/critical` CI gate. Use when the team wants Grype-native vuln scanning, or pairs with Syft (syft-generation) for an SBOM-driven workflow.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable skill body with clean step sequencing, a real triage feedback loop, and proper one-level reference offloading. Its main weakness is mild verbosity from repeated source attribution and inline time-sensitive values.

Suggestions

Replace the recurring `Per [gr-gh][gr-gh]:` attribution lines with a single 'Commands per the Grype docs' note plus the reference link in the References section to cut repeated boilerplate.

Move version-pinned DB examples and concrete `expires:` dates out of the main flow into a 'CI determinism / pinning' or 'old patterns' callout so the dates don't age the core instructions.

Drop the re-quoted ecosystem coverage block (Alpine/Debian/.../Rust) from the body since the same list already appears in the description frontmatter, keeping the body focused on how-to.

DimensionReasoningScore

Conciseness

Mostly efficient and actionable, but the body carries some redundancy — the ecosystem list is re-quoted from Grype's README, `Per [gr-gh][gr-gh]:` attribution recurs ~8 times, and time-sensitive dates (`grype-db-v6-2026-05-06.tar.gz`, `expires: 2026-09-15`) sit inline rather than in a deprecated/old-patterns section.

2 / 3

Actionability

Provides fully executable, copy-paste-ready commands for every input mode and output format, a complete `anchore/scan-action` CI workflow, and concrete `.grype.yaml` suppressions — no pseudocode.

3 / 3

Workflow Clarity

A clearly numbered 8-step sequence is mirrored by an inline summary, and the worked example demonstrates an explicit feedback loop (scan → exit 1 → triage into `.grype.yaml` with `expires:` → re-scan → exit 0) covering the risky suppression operation.

3 / 3

Progressive Disclosure

SKILL.md is an overview that offloads the full `.grype.yaml` config and justification template to a single one-level-deep, clearly signaled reference at references/grype-ignore-rules.md (verified to exist), with no nested reference chains.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete capabilities, supplies a natural trigger clause, and explicitly differentiates the skill from adjacent tools. It is dense but every clause earns its place.

DimensionReasoningScore

Specificity

Lists multiple concrete actions across three input modes (`grype sbom:./sbom.json` / `grype {image}` / `grype dir:./`), per-CVE/per-package ignore rules, EPSS+KEV prioritization, OpenVEX filtering, and a `--fail-on high/critical` CI gate.

3 / 3

Completeness

Explicitly answers what it does (Grype scanning + suppression + prioritization + CI gating) and when to use it via a clear 'Use when the team wants Grype-native vuln scanning, or pairs with Syft' trigger clause.

3 / 3

Trigger Term Quality

Natural user-facing terms appear ('Scans for vulnerabilities', 'vuln scanning', 'SBOM', 'CI gate') alongside the tool name; these are the phrases a user would actually say when reaching for this skill.

3 / 3

Distinctiveness Conflict Risk

Carves a clear Grype-native niche and explicitly distinguishes it from standalone VEX authoring (`vex-author`) and from sister tool `syft-generation`, so it is unlikely to trigger for the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents