CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/trivy-image

Configures and runs Trivy for container image scanning: Aqua Security's all-in-one scanner combining vuln + secret + misconfiguration + license detection in one pass; `trivy image {image}` with --severity HIGH,CRITICAL filter; --format sarif/json (incl. scan-embedded CycloneDX; for standalone SBOM generation see syft-generation + sbom-formats); .trivyignore CVE suppression file; --ignore-unfixed for actionable filter; --scanners vuln/misconfig/license/secret toggle. Use when the team wants a single tool covering container image security across multiple dimensions, not for producing a standalone CycloneDX SBOM.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is action-oriented with executable commands, a clear multi-step workflow including mandatory triage validation, and clean progressive disclosure to a real reference file. Only slight conciseness gains remain from trimming a few explanatory asides.

DimensionReasoningScore

Conciseness

Mostly lean and table-driven, assuming Claude knows Trivy basics, with only minor prose that could be trimmed (e.g., the secret-scan blockquote and a few elaborative clauses).

4 / 5

Actionability

Provides fully executable, copy-paste-ready commands throughout (e.g., 'trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 my-image:1.0') plus a concrete .trivyignore example and a CI workflow in the reference file, covering the common cases.

5 / 5

Workflow Clarity

Clear sequenced Steps 1–10 with explicit validation/triage checkpoints (mandatory Step 8 false-positive triage with justification template, quarterly audit cadence) and an anti-patterns table providing error-recovery guidance.

5 / 5

Progressive Disclosure

SKILL.md is a well-organized overview spine that offloads the full CI workflow and sister-tool composition table to references/ci-and-composition.md (verified real file) via clearly signaled, one-level-deep links in Steps 9–10 and References.

5 / 5

Total

19

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and answers both what the skill does and when to use it with concrete triggers and explicit boundary guidance against sister tools. Minor room to surface more natural user phrasings alongside the flag-heavy detail.

DimensionReasoningScore

Specificity

Lists multiple concrete capabilities and flags — vuln/secret/misconfig/license detection, --severity, --format sarif/json, .trivyignore, --ignore-unfixed, --scanners toggle — giving comprehensive coverage rather than vague abstractions.

5 / 5

Completeness

Explicitly answers both 'what' ('Configures and runs Trivy ... all-in-one scanner combining vuln + secret + misconfiguration + license detection') and 'when' ('Use when the team wants a single tool covering container image security across multiple dimensions').

5 / 5

Trigger Term Quality

Includes natural terms users would say ('container image scanning', 'Trivy', 'CVE', 'SBOM') with good synonym coverage, but is heavily flag-driven and misses some plain-language phrasings users might naturally use.

4 / 5

Distinctiveness Conflict Risk

Clearly niched to Trivy image scanning and explicitly disambiguated from sister skills ('for standalone SBOM generation see syft-generation + sbom-formats'; 'not for producing a standalone CycloneDX SBOM'), minimizing overlap risk.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents