mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-30 16:06:52 +03:00
mukul975
8cae0648ec
Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):
- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
invocation, guardrails, model/data poisoning, system-prompt leakage,
embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration
Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.
76 lines
2.9 KiB
Markdown
76 lines
2.9 KiB
Markdown
# Trivy — Command and Flag Reference
|
|
|
|
## Scan Targets (subcommands)
|
|
|
|
| Command | Target | Example |
|
|
|---------|--------|---------|
|
|
| `trivy image` | Container image (registry/tar) | `trivy image alpine:3.19` |
|
|
| `trivy fs` | Local filesystem / project dir | `trivy fs ./` |
|
|
| `trivy repository` (`repo`) | Git repository (local or remote URL) | `trivy repo https://github.com/org/repo` |
|
|
| `trivy config` | IaC / config misconfiguration | `trivy config ./infra` |
|
|
| `trivy sbom` | Existing SBOM (CycloneDX/SPDX) | `trivy sbom sbom.cdx.json` |
|
|
| `trivy kubernetes` (`k8s`) | Live Kubernetes cluster | `trivy k8s --report summary cluster` |
|
|
| `trivy vm` | VM image (AMI/EBS/VMDK) | `trivy vm ami:ami-0123` |
|
|
| `trivy rootfs` | Extracted root filesystem | `trivy rootfs /mnt/rootfs` |
|
|
|
|
## Key Flags
|
|
|
|
| Flag | Description |
|
|
|------|-------------|
|
|
| `--scanners vuln,misconfig,secret,license` | Select which scanners to run |
|
|
| `--severity LOW,MEDIUM,HIGH,CRITICAL` | Filter results by severity |
|
|
| `--exit-code <n>` | Exit code when matching results are found (gating) |
|
|
| `--ignore-unfixed` | Suppress vulnerabilities with no fixed version |
|
|
| `--format table\|json\|sarif\|cyclonedx\|spdx-json` | Output format |
|
|
| `--output <file>` | Write report to file |
|
|
| `--input <file>` | Scan an image tar instead of a registry ref |
|
|
| `--vuln-type os,library` | Limit vulnerability detection scope |
|
|
| `--image-config-scanners misconfig,secret` | Scan image build config/history |
|
|
| `--config-policy <dir>` | Custom Rego misconfig policy directory |
|
|
| `--policy-namespaces <ns>` | Rego policy namespaces to evaluate |
|
|
| `--download-db-only` | Pre-download vulnerability DB (caching/air-gap) |
|
|
| `--download-java-db-only` | Pre-download Java index DB |
|
|
| `--skip-dirs` / `--skip-files` | Exclude paths from scan |
|
|
| `--ignorefile <path>` | Path to `.trivyignore` (default `.trivyignore`) |
|
|
|
|
## Output Formats
|
|
|
|
| Format | Use |
|
|
|--------|-----|
|
|
| `table` | Human-readable console (default) |
|
|
| `json` | Programmatic gating / parsing |
|
|
| `sarif` | GitHub code scanning / IDE ingestion |
|
|
| `cyclonedx` | CycloneDX SBOM |
|
|
| `spdx-json` | SPDX SBOM (JSON) |
|
|
| `github` | GitHub dependency snapshot |
|
|
|
|
## `.trivyignore` Format
|
|
|
|
```
|
|
# One ID per line; supports CVE, AVD (misconfig), and secret rule IDs
|
|
CVE-2023-12345
|
|
AVD-AWS-0089
|
|
generic-api-key
|
|
```
|
|
|
|
## GitHub Actions (trivy-action)
|
|
|
|
```yaml
|
|
- uses: aquasecurity/trivy-action@master
|
|
with:
|
|
scan-type: 'image' # image | fs | config | repo | sbom
|
|
image-ref: 'myorg/app:1.4.0'
|
|
format: 'sarif'
|
|
output: 'trivy-results.sarif'
|
|
severity: 'HIGH,CRITICAL'
|
|
ignore-unfixed: true
|
|
exit-code: '1'
|
|
```
|
|
|
|
## External References
|
|
|
|
- Trivy Docs: https://trivy.dev/latest/docs/
|
|
- Configuration reference: https://trivy.dev/latest/docs/configuration/
|
|
- Misconfiguration scanning: https://trivy.dev/latest/docs/scanner/misconfiguration/
|
|
- SBOM: https://trivy.dev/latest/docs/supply-chain/sbom/
|