trivy SKILL.md skillA
trivy from nitinjain999/platform-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add nitinjain999/platform-skills/trivy@git:20261017.0361a9bPins git:20261017.0361a9b in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- nitinjain999/platform-skills
- Path
skills/trivy/SKILL.md- Versions recorded
- 2
- Latest version
- git:20261017.0361a9b, committed Oct 17, 2026
- First version recorded
- Oct 11, 2026
- Size
- 9,340 bytes
- Repository stars
- 71
- License
- Apache-2.0
Scan container images, filesystems, git repos, and existing SBOMs for CVEs, secrets, and license violations using Trivy. Covers local CLI, CI severity gates with SARIF upload, and continuous monitoring via Trivy Operator (Flux HelmRelease). Use when asked to "scan my image", "check for CVEs", "scan this repo for secrets", "scan an SBOM", or "set up continuous cluster vulnerability monitoring". IaC misconfig → /platform-skills:checkov. Admission posture → /platform-skills:kyverno. Image…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
Scan for vulnerabilities, secrets, and license violations — from local dev to running cluster. Read `references/trivy.md` before responding. It contains all mode logic, bootstrap steps, severity gating, output formats, `.trivyignore` patterns, and the Trivy Operator install via Flux HelmRelease. ## Ownership boundary (enforced at the menu) | Question | Authoritative command | |---|---| | "Is there a misconfig in my Terraform?" | `/platform-skills:checkov` | | "Will this manifest pass admission?" | `/platform-skills:kyverno apply` | | "How do I sign my image / generate an SBOM?" | `/platform-skills:supply-chain` | | "Is this image safe to ship?" | **this command** | | "Are there secrets in this repo?" (fast, offline pattern match) | **this command** | | "Is that secret still live? What can it reach? Revoke it." | `/platform-skills:kingfisher` | | "What CVEs are running in my cluster?" | **this command** (`k8s` / Operator) | | "Which of those CVEs are in packages that actually load?" (cluster runs Kubescape) | `/platform-skills:kubescape-operator vulns` — run one CVE operator per cluster, not both | …
Read the whole file at its exact version.
How to install
mdr add nitinjain999/platform-skills/trivy@sha256:bf8d95222a887773The line at the top of this page pins the label git:20261017.0361a9b, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_6hcbg7hnog5es67d)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Oct 11, 2026 and Oct 17, 2026, about one every 6 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261017.0361a9b latest | 2026-10-17 | 0361a9b | 9,340 B | A | view · diff |
| git:20261011.e8166a5 | 2026-10-11 | e8166a5 | 9,064 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9340 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
nitinjain999/platform-skills · 71 stars · license Apache-2.0 · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_6hcbg7hnog5es67d GET https://markdownregistry.com/api/v1/resolve?ref=nitinjain999/platform-skills/trivy GET https://markdownregistry.com/api/v1/blob/bf8d95222a8877733a8ad7185b6b47ebeff74a92c04df7a25ca82722c16670a0
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from nitinjain999/platform-skills
Every file in nitinjain999/platform-skills