CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/trivy-image

Configures and runs Trivy for container image scanning: Aqua Security's all-in-one scanner combining vuln + secret + misconfiguration + license detection in one pass; `trivy image {image}` with --severity HIGH,CRITICAL filter; --format sarif/json (incl. scan-embedded CycloneDX; for standalone SBOM generation see syft-generation + cyclonedx-format); .trivyignore CVE suppression file; --ignore-unfixed for actionable filter; --scanners vuln/misconfig/license/secret toggle. Use when the team wants a single tool covering container image security across multiple dimensions, not for producing a standalone CycloneDX SBOM.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and well-structured, with executable commands, a clear step sequence, explicit triage/audit checkpoints, and a properly signaled one-level-deep reference file. Its main weakness is conciseness: some redundancy across the Overview, description, and repeated citations could be trimmed.

Suggestions

Remove the all-in-one distinction from the Overview (or shrink it to one line) since the frontmatter description already states it, letting the body open with the scanner-toggle table directly.

Replace the repeated 'Per [tv-img][tv-img]' lead-ins before each step with a single citation convention (e.g. one note at the top) to cut ~9 redundant phrases.

Tighten Step 6's blockquote into a one-line note ('Secret findings appear alongside vuln findings; for deeper secret scanning see gitleaks-scanning + trufflehog-scanning') instead of restating what secret detection does.

DimensionReasoningScore

Conciseness

Mostly efficient (tables, code blocks, minimal prose) but includes redundancy — the Overview restates the all-in-one distinction already in the description, Step 6 blockquote re-explains what secret scanning is, and 'Per [tv-img][tv-img]' is repeated verbatim before most steps. Not a 3 because it could be tightened; not a 1 because it avoids padding with basics Claude already knows.

2 / 3

Actionability

Fully executable, copy-paste-ready commands throughout: 'trivy image --scanners vuln,secret,misconfig,license python:3.4-alpine', '--severity HIGH,CRITICAL --exit-code 1', '--format json --output trivy-image.json', and a concrete '.trivyignore' example with real CVE IDs and a justification block.

3 / 3

Workflow Clarity

Steps 1–10 are clearly sequenced with explicit checkpoints: exit-code semantics ('0 = no findings... 1 = findings present'), a MANDATORY Step 8 justification template, and a quarterly '.trivyignore' audit cadence. Not below 3 because scanning is non-destructive and verification checkpoints are present.

3 / 3

Progressive Disclosure

SKILL.md acts as a spine keeping scan commands inline while offloading the full CI workflow and sister-tool composition table to the real, one-level-deep 'references/ci-and-composition.md', clearly signaled in Step 9, Step 10, and the References section.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinctive: it names concrete actions, gives an explicit 'Use when' trigger, and clearly separates this all-in-one scanner from standalone-SBOM sister skills. Its only mild weakness is a high density of flag-level jargon that slightly dilutes natural trigger phrasing.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions: 'Configures and runs Trivy for container image scanning', 'combining vuln + secret + misconfig + license detection in one pass', '--severity HIGH,CRITICAL filter', '.trivyignore CVE suppression file', and '--ignore-unfixed for actionable filter'.

3 / 3

Completeness

Explicitly answers both what ('Configures and runs Trivy... all-in-one scanner combining vuln + secret + misconfig + license detection') and when ('Use when the team wants a single tool covering container image security across multiple dimensions, not for producing a standalone CycloneDX SBOM').

3 / 3

Trigger Term Quality

Good coverage of natural terms a user would say — 'container image scanning', 'Trivy', 'vuln + secret + misconfig + license', 'container image security across multiple dimensions' — though it leans on flag-level jargon alongside them.

3 / 3

Distinctiveness Conflict Risk

Clear niche as the all-in-one Trivy image scanner, explicitly distinguished from sister tools ('for standalone SBOM generation see syft-generation + cyclonedx-format', 'not for producing a standalone CycloneDX SBOM'), making wrong-skill triggering unlikely.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents