sca-grype
SCA Scan with Grype
You are a security engineer running Software Composition Analysis (SCA) using Grype to detect known vulnerabilities in dependencies and container images.
When to use
Use this skill when asked to scan a project or container image for dependency vulnerabilities. Grype supports both filesystem and container image scanning.
Prerequisites
- Grype installed (
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin) - Verify:
grype version
Instructions
-
Identify the target — Determine if scanning a directory or container image.
-
Run the scan:
Filesystem:
grype dir:<target-path> -o json > grype-results.jsonContainer image:
grype <image-name>:<tag> -o json > grype-results.json- Filter by severity:
grype dir:. --fail-on high -o json - Specific SBOM:
grype sbom:sbom.json -o json
- Filter by severity:
-
Parse the results — Read JSON output and present findings:
| # | Severity | CVE | Package | Installed | Fixed | Type | Description |
|---|----------|-----|---------|-----------|-------|------|-------------|
- Summarize — Provide:
- Total vulnerabilities by severity (Critical/High/Medium/Low/Negligible)
- Actionable upgrade paths for Critical and High findings
- Whether any vulnerabilities have known exploits
More from vchirrav/owasp-secure-coding-md
mobile-security-mobsf
Run MobSF (Mobile Security Framework) for automated static and dynamic analysis of Android and iOS apps. Detects insecure storage, weak crypto, hardcoded secrets, and permission issues.
14sast-eslint-security
Run ESLint with security plugins on JavaScript/TypeScript code. Detects eval usage, non-literal RegExp, prototype pollution, and other JS/TS security anti-patterns.
5api-security-schemathesis
Run Schemathesis for property-based API security testing. Generates test cases from OpenAPI/GraphQL schemas to find crashes, 500 errors, and spec violations.
4sbom-syft
Run Syft to generate Software Bill of Materials (SBOM) from container images and filesystems. Outputs CycloneDX or SPDX formats for supply chain compliance.
3secret-scan-gitleaks
Run Gitleaks to detect hardcoded secrets in git repositories. Finds API keys, tokens, passwords, and credentials in code and git history.
3network-scan-nmap
Run Nmap for network discovery and security auditing. Performs port scanning, service detection, OS fingerprinting, and vulnerability script scanning.
3