CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/trivy-config

Runs Trivy's misconfiguration scanner (`trivy config`) against IaC directories to detect security issues across Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles, and Azure ARM templates - installs Trivy, scans with severity gating via `--exit-code`, suppresses findings via `.trivyignore` / `.trivyignore.yaml` or inline annotations, extends built-in checks with custom Rego policies, and emits SARIF for GitHub Code Scanning. Trivy is the forward path from tfsec (per Aqua Security's own migration guidance). Use when adopting a consolidated IaC scanner for new projects, migrating away from tfsec, or scanning mixed IaC stacks with a single tool.

79

Quality

99%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, executable walkthrough with concrete commands, a clear step sequence plus verification and ratchet checkpoints, and clean one-level references into a real bundle file. It avoids concept padding and time-sensitive content is appropriately isolated in the Pinned versions section.

DimensionReasoningScore

Conciseness

Lean and efficient: it assumes Claude's competence, drops no preamble explaining what IaC or Trivy is, uses compact tables for flags/formats/pins/anti-patterns, and pushes full Rego and workflow YAML into the reference file rather than inlining them. Every token earns its place.

3 / 3

Actionability

Provides fully executable copy-paste commands throughout — `trivy config .`, `trivy config --exit-code 1 --severity HIGH,CRITICAL .`, the install snippets, the SARIF/JUnit templates — with specific flags and concrete examples, not pseudocode.

3 / 3

Workflow Clarity

Clear numbered sequence (Step 1 install → Step 2 scan → Step 3 gating → ... → Step 7 CI) with a verification checkpoint ('Verify: `trivy --version`'), a ratchet/feedback pattern for severity gating, and an anti-patterns table that functions as an error-recovery checklist.

3 / 3

Progressive Disclosure

Well-structured spine with clearly signaled one-level-deep references to the verified `references/trivy-config.md` for the full Rego policy example and GitHub Actions workflow; detailed blocks are appropriately split out rather than nested multiple levels deep.

3 / 3

Total

12

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific, third-person, and explicitly answers both what the skill does and when to use it, with strong trigger coverage and a clear niche distinct from sibling tfsec/checkov skills. It is slightly long but earns every clause with concrete capability and trigger content.

DimensionReasoningScore

Specificity

Lists many concrete actions — 'installs Trivy', 'scans with severity gating via `--exit-code`', 'suppresses findings via `.trivyignore` / `.trivyignore.yaml`', 'extends built-in checks with custom Rego policies', 'emits SARIF for GitHub Code Scanning' — matching the anchor for listing multiple specific concrete actions.

3 / 3

Completeness

Clearly answers both: what it does (runs Trivy config scanning, gating, suppression, custom Rego, SARIF) and when to use it via an explicit 'Use when adopting a consolidated IaC scanner..., migrating away from tfsec, or scanning mixed IaC stacks with a single tool' clause.

3 / 3

Trigger Term Quality

Covers natural user-facing terms — 'Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles', 'migrating away from tfsec', 'IaC scanner', 'security issues' — a broad, natural set a user would actually say, plus a keyword-rich metadata block.

3 / 3

Distinctiveness Conflict Risk

Has a clear niche — Trivy's IaC misconfig scanning as the tfsec forward path — with distinct triggers (named IaC formats, tfsec migration), making conflict with sibling skills like checkov/tfsec unlikely.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents