container-image-scanning

仓库创建 2026年7月26日最近提交 3 天前SkillHot 收录 2 天前

这个 Skill 做什么

把容器镜像当成整个系统来扫：不仅查你写的代码，还查基础镜像和库里的已知 CVE、泄露的秘密和不良实践。推镜像前或 CI 中常用，重点是把海量扫描结果过滤成真正值得修的几项。特别在于区分继承来的漏洞和自己引入的问题，帮助优先修复。

▸ 展开 SKILL.md 英文原文

Use when you need to check a container image for known vulnerabilities, exposed secrets, and bad practice before it ships — and how to keep the results actionable.

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/07-container-and-kubernetes-security/01-container-image-scanning/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/07-container-and-kubernetes-security/01-container-image-scanning/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

A container image is your code plus a whole OS and every library underneath it. Most of the CVEs in a scan aren't yours — they're in the base image and dependencies you inherited. This skill covers scanning an image for known vulnerabilities and secrets, and, just as importantly, turning the wall of results into the few things worth fixing.

## When to use it

Before pushing an image, in CI on every build, and periodically against images already running (new CVEs get disclosed against images that haven't changed). Also when auditing a base image you're considering standardising on.

## Procedure

1. Scan the built image for known vulnerabilities. Trivy reads the OS packages and l

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有