skills.rest
masermediagroup-stack
masermediagroup-stackCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

managing-vulnerabilities

Implement multi-layer security scanning, SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines.

1|Updated Feb 24, 2026
Search Tags:#devsecops#ci/cd security#vulnerability scanning#cvss#trivy#sbom#secret scanning
One-click install
npx skills add https://github.com/masermediagroup-stack/maser-media --skill managing-vulnerabilities-masermediagroup-stack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: managing-vulnerabilities
Source: https://github.com/masermediagroup-stack/maser-media/tree/main/.cursor/skills/community/ai-design-components/skills/managing-vulnerabilities
Command: npx skills add https://github.com/masermediagroup-stack/maser-media --skill managing-vulnerabilities-masermediagroup-stack

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security teams struggle to detect, prioritize, and remediate vulnerabilities across containers, source code, dependencies, and running applications without drowning in unactionable scan results. ## Core Features & Use Cases - Multi-Layer Scanning: Configure container scanning (Trivy, Grype), SAST (Semgrep), DAST (OWASP ZAP), SCA (Dependabot, Renovate), and secret scanning (Gitleaks) across pipeline stages. - SBOM Generation: Produce CycloneDX and SPDX Software Bills of Materials with Trivy or Syft for compliance mandates like Executive Order 14028. - Risk-Based Prioritization: Combine CVSS, EPSS, and CISA KEV data with asset criticality to assign P0-P4 SLA tiers instead of patching everything. - Use Case: Add a GitHub Actions pipeline that fails builds on Critical container vulnerabilities, generates an SBOM artifact, and routes findings into a remediation workflow with SLA tracking. ## Quick Start Ask the AI to set up a Trivy container scan in your CI pipeline that fails the build on HIGH and CRITICAL vulnerabilities and generates a CycloneDX SBOM.

Frequently Asked Questions about managing-vulnerabilities

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan container images for vulnerabilities in CI/CD?▼

Use Trivy in your pipeline with a severity filter and exit code, for example trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest. In GitHub Actions, the aquasecurity/trivy-action step can output SARIF results and upload them to the GitHub Security tab.

Trivy vs Grype: which container scanner should I use?▼

Trivy is the default choice for comprehensive coverage including OS packages, language libraries, secrets, and misconfigurations in one tool. Grype focuses on minimal false positives and pairs with Syft for SBOM-first workflows, making it better when accuracy matters more than breadth.

How do I generate an SBOM for a container image?▼

Run trivy image --format cyclonedx --output sbom.json myapp:latest for a security-focused CycloneDX SBOM, or use syft myapp:latest -o spdx-json=sbom.json for SPDX compliance output. You can then scan the SBOM directly with trivy sbom sbom.json for faster re-scans.

How do I prioritize which vulnerabilities to fix first?▼

Combine CVSS severity, EPSS exploitation probability from the FIRST.org API, and CISA KEV catalog status with asset criticality and exposure. Vulnerabilities in the KEV catalog on internet-facing critical assets get P0 treatment with a 24-hour SLA, while low-CVSS low-EPSS findings go to the backlog.

Can I enforce vulnerability policies automatically in pipelines?▼

Yes, use OPA (Open Policy Agent) with Rego policies evaluated against Trivy JSON scan output. Policies can deny builds on Critical severities, KEV-listed CVEs, or CVSS scores above a threshold, and can vary rules per environment such as production versus staging.

How do I handle false positives from Trivy scans?▼

Add the CVE ID to a .trivyignore file with a documented justification, approver, and review date. The skill also describes a GitHub Actions workflow that converts labeled false-positive issues into suppression entries via an automated pull request.

Related Skills

Explore More Software Engineering Skills→
marquesfelipmarquesfelip

dependency-security-scanning

Standardize SCA tooling and policy enforcement for dependency vulnerabilities in CI/CD.

Community
Intermediate
saolalabsaolalab
37

vulnerability-management

Track security vulnerabilities with CVSS severity mapping and SLA-aligned remediation timelines.

Official
Intermediate
devendrapratapsinghdevendrapratapsingh
1

security

Scan code, containers, and infrastructure for security vulnerabilities.

Community
Advanced
OpenLaborOpenLabor
4

Security Scan

Identify and remediate security vulnerabilities in codebases and infrastructure.

Official
Intermediate