---

name: trivy description: >- Security vulnerability scanning using Trivy for ecommerce project. Scans dependencies, container images, and IaC. Blocks CRITICAL and HIGH severity. Triggers on "trivy", "vulnerability scan", "security scan", "container scan", "cve", "dependency scan", "npm audit", "docker scan", "security check". PROACTIVE: MUST invoke before committing code with new dependencies. allowed-tools: Read, Write, Edit, Bash, Glob, Grep

ABOUTME: Security vulnerability scanning skill using Trivy

ABOUTME: Enforces CRITICAL/HIGH blocking before commits

Trivy Security Scanning Skill

Quick Reference

---

When to Scan

---

Scan Commands

Filesystem Scan (Dependencies)

Copy# Most common - scan Node.js dependencies
trivy fs \
    --severity CRITICAL,HIGH \
    --exit-code 1 \
    --ignore-unfixed \
    --format table \
    .

Container Image Scan

Copy# Build image first
docker build -t local-scan:latest .

# Scan the image
trivy image \
    --severity CRITICAL,HIGH \
    --exit-code 1 \
    --ignore-unfixed \
    local-scan:latest

IaC Configuration Scan

Copy# Scan Terraform files
trivy config \
    --severity CRITICAL,HIGH \
    --exit-code 1 \
    infra/terraform/

---

Severity Policy

---

Remediation Strategies

Strategy 1: Upgrade Package

Copy# Check which version fixes the CVE
npm audit

# Upgrade specific package
npm install package@latest

# Or use npm audit fix
npm audit fix

Strategy 2: Find Fixed Version

Copy# Show fixed versions in JSON
trivy fs --severity CRITICAL,HIGH --format json . | \
  jq '.Results[].Vulnerabilities[] | {pkg: .PkgName, installed: .InstalledVersion, fixed: .FixedVersion}'

Strategy 3: Override Transitive Dependency

Copy// package.json
{
  "overrides": {
    "vulnerable-package": "^X.Y.Z"
  }
}

Strategy 4: Exclude False Positive

Create .trivyignore:

Copy# CVE-2023-XXXXX: Not exploitable - we don't use affected feature
CVE-2023-XXXXX

WARNING: Every exclusion MUST have documented justification.

---

Ecommerce-Specific Patterns

Backend Scan

Copycd apps/backend
trivy fs --severity CRITICAL,HIGH --exit-code 1 .

Frontend Scan

Copycd apps/frontend
trivy fs --severity CRITICAL,HIGH --exit-code 1 .

Docker Compose Scan

Copy# Build all images
docker-compose -f docker-compose.full.yml build

# Scan each
trivy image ecommerce-demo-backend:latest
trivy image ecommerce-demo-frontend:latest

Terraform Scan

Copytrivy config --severity CRITICAL,HIGH infra/terraform/

---

CI Integration

The project has Trivy in CI (.github/workflows/backend-ci.yml):

Copy- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    scan-ref: 'apps/backend'
    format: 'json'
    output: 'security/reports/trivy-backend-${{ github.sha }}.json'

Reports saved to security/reports/ for Claude CVE analysis.

---

CVE Analysis Workflow

When Trivy finds vulnerabilities:

1. Get the report

   Copytrivy fs --format json --output report.json .
   

2. Ask Claude to analyze

   CopyAnalyze report.json for contextual CVE prioritization.
   For each CVE:
   - Search codebase for usage of affected library
   - Evaluate if attack vector is exposed
   - Provide remediation priority
   

3. Follow remediation plan

---

Checklist

Before committing with dependency changes:

• Trivy installed (brew install trivy)
• Ran trivy fs --severity CRITICAL,HIGH --exit-code 1 .
• No CRITICAL vulnerabilities
• No HIGH vulnerabilities (or documented exception)
• Any .trivyignore entries justified
• Container images scanned (if Dockerfile changed)
• IaC scanned (if Terraform changed)

---

Troubleshooting