Vulnerability Scanning

Covers the basics of automated security scanning with Trivy, Snyk, and npm audit across dependencies, containers, and code. You get working examples for local scans, a GitHub Actions workflow that fails on high/critical findings, and quick snippets for Python's Bandit and Safety tools. The CI/CD integration is the real value here since it shows how to actually gate deployments on security issues. Missing some depth on handling false positives and vulnerability triage, but it's a solid starting point if you need to add security scanning to a pipeline and don't want to figure out all the CLI flags yourself.

skills.sh installs: 534
GitHub stars: 248
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add secondsky/claude-skills --skill vulnerability-scanning --agent claude-code

Installs into .claude/skills of the current project.

Files

Vulnerability Scanning

Automate security vulnerability detection across code, dependencies, and containers.

Dependency Scanning

# npm audit
npm audit --audit-level=high

# Snyk
snyk test --severity-threshold=high

# Safety (Python)
safety check --full-report

Container Scanning (Trivy)

# Scan container image
trivy image myapp:latest --severity HIGH,CRITICAL

# Scan filesystem
trivy fs --scanners vuln,secret .

GitHub Actions Integration

name: Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: 'fs'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

      - name: Run Snyk
        uses: snyk/actions/node@v3
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

      - name: npm audit
        run: npm audit --audit-level=high