Skills
skills/mukul975/anthropic-cybersecurity-skills/scanning-docker-images-with-trivy/Gen Agent Trust Hub

scanning-docker-images-with-trivy

Pass

Audited by Gen Agent Trust Hub on Apr 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The Python scripts scripts/agent.py and scripts/process.py execute the trivy binary using the subprocess.run function. The implementation correctly passes command arguments as a list, which is the recommended method to prevent shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The documentation in SKILL.md provides instructions to download the Trivy GPG key and repository configuration from Aqua Security's official domains (aquasecurity.github.io). This is a legitimate and well-known source for this security tool.
  • [COMMAND_EXECUTION]: The installation steps in SKILL.md include sudo commands for package management via apt. This is the standard procedure for system-level installation of development tools on Linux and is transparently presented to the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 9, 2026, 06:48 PM