Skill UI

This skill acts as a specialized security expert for analyzing project dependencies. It scans dependencies across multiple ecosystems (e.g., npm, pip, Maven) to identify known vulnerabilities, assess associated risks, and generate Software Bill of Materials (SBOMs). It provides comprehensive insights into supply chain security and offers automated strategies for remediation, ensuring compliance and stability during development.

Deploy Aqua Security's Trivy scanner within CI/CD pipelines, registries, and Kubernetes clusters to scan container images, repos, IaC, and workloads for vulnerabilities, misconfigurations, secrets, and SBOM/license issues.

Use Sigstore Cosign to sign, attest, and verify container images with keyless OIDC signing, SBOM/vulnerability attestations, and CI/CD admission enforcement for supply chain provenance security.

Implements container build integrity by orchestrating in-toto attestations across CI/CD steps, ensuring signed provenance, SBOMs, and policy-compliant deployment verification in Kubernetes environments.

Uses Aqua Security Trivy to scan container images, filesystems, IaC, and Kubernetes manifests for vulnerabilities, secrets, and license issues while generating SBOMs and integrating into CI/CD pipelines for triage-ready reports.

Use Anchore Grype to scan container images, archives, and SBOMs for known CVEs, enforce severity thresholds, and integrate results into CI/CD pipelines for consistent container security posture.

Use Trivy to scan Docker and OCI images for OS/library CVEs, secrets, misconfigurations, licenses, and SBOM data; integrates with CI/CD pipelines and exports SARIF/JSON/CycloneDX for policy enforcement.

Defines workflows for scanning container registry images via Trivy and Grype, generating SBOMs, signing artifacts with Cosign/Sigstore, and configuring registry policies plus CI/CD gates to block unscanned or unsigned images.

Step-by-step workflow for uncovering XML-based vulnerabilities such as XXE, XPath injection, SSRF, and entity bombs in web apps, covering prerequisites, payload templates, and out-of-band detection techniques.

Parses CycloneDX and SPDX SBOMs, maps components to the NVD CVE catalog, scores their risk via dependency graphs, and produces compliance-ready reports for supply chain security assessments and automated CI/CD scans.