fix-scan-finding

80 / 100 · Low risk

Fine to try.

By malloydata/publisher (GitHub) · data · 132 stars · scanned at commit bb8ce0d

Fix a CRITICAL Trivy finding that is failing CI in this repo (a vulnerability, misconfiguration, or secret from security-scan.yml or image-scan.yml), or add, review, or retire an entry in .trivyignore.yaml. Drives the decision the gate forces: fix it upstream, or accept it with an expiry. Read it before the first scanner command or security-motivated dependency bump, including on a gate that is already green. Trigger on "CVE", "trivy", "trivyignore", "code scanning", "scan finding", "vulnerabil…

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

The author does not mention this.

Found in 3 places.

.claude/skills/fix-scan-finding/SKILL.md, line 22**Prerequisites:** `trivy` on PATH (`brew install trivy`, or see the Trivy install docs), `bun` at
.claude/skills/fix-scan-finding/references/ecosystems.md, line 181dropping `dnsutils` from the `Dockerfile`'s `apt-get install` fixed all four. That is option 4 of
.claude/skills/fix-scan-finding/references/root-cause-grouping.md, line 59| Unfixed Debian CVEs (`Status: affected`) in `liblmdb0` / `libxml2`, via `dnsutils` -> `bind9-libs` | `dnsutils` removed from the `Dockerfile`'s `apt-get insta

Runs commands on your computer

The author does not mention this.

Found in 4 places.

.claude/skills/fix-scan-finding/SKILL.md, line 71trivy fs . --scanners vuln --severity CRITICAL \
.claude/skills/fix-scan-finding/SKILL.md, line 94docker buildx build --platform <platform> --load \
.claude/skills/fix-scan-finding/SKILL.md, line 120npm view <pkg> dist-tags

Show 1 more

.claude/skills/fix-scan-finding/SKILL.md, line 284git add <changed files>

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'fix-scan-finding' ] || [ -L ~/.agents/skills/'fix-scan-finding' ]; then echo 'A skill folder named fix-scan-finding already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/malloydata/publisher' "$d" && git -C "$d" checkout --quiet 'bb8ce0db61c90d45273e4b65c5ccfc6475a9193a' -- '.claude/skills/fix-scan-finding' && mkdir -p ~/.agents/skills && cp -R "$d"/'.claude/skills/fix-scan-finding' ~/.agents/skills/'fix-scan-finding' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'fix-scan-finding' ~/.claude/skills/'fix-scan-finding' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for malloydata/publisher shows the score of its lowest-scoring skill.

SkillTrust badge for malloydata/publisher

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/malloydata/publisher.svg)](https://zalavijaysinh.github.io/skilltrust/repos/malloydata/publisher/)

Score history

Date	Version	Score
2026-11-14	`bb8ce0d`	80