From 851c4fbb0371aea5c1a07f986ad3088bbf3dc1b1 Mon Sep 17 00:00:00 2001 From: Zhongwei Li Date: Sun, 30 Nov 2025 08:19:10 +0800 Subject: [PATCH] Initial commit --- .claude-plugin/plugin.json | 15 +++++ README.md | 3 + commands/container-scan.md | 25 ++++++++ plugin.lock.json | 61 +++++++++++++++++++ skills/container-security-scanner/SKILL.md | 52 ++++++++++++++++ .../assets/README.md | 7 +++ .../references/README.md | 8 +++ .../scripts/README.md | 8 +++ 8 files changed, 179 insertions(+) create mode 100644 .claude-plugin/plugin.json create mode 100644 README.md create mode 100644 commands/container-scan.md create mode 100644 plugin.lock.json create mode 100644 skills/container-security-scanner/SKILL.md create mode 100644 skills/container-security-scanner/assets/README.md create mode 100644 skills/container-security-scanner/references/README.md create mode 100644 skills/container-security-scanner/scripts/README.md diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json new file mode 100644 index 0000000..4e38ce6 --- /dev/null +++ b/.claude-plugin/plugin.json @@ -0,0 +1,15 @@ +{ + "name": "container-security-scanner", + "description": "Scan containers for vulnerabilities using Trivy, Snyk, and other security tools", + "version": "1.0.0", + "author": { + "name": "Claude Code Plugins", + "email": "[email protected]" + }, + "skills": [ + "./skills" + ], + "commands": [ + "./commands" + ] +} \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..4468931 --- /dev/null +++ b/README.md @@ -0,0 +1,3 @@ +# container-security-scanner + +Scan containers for vulnerabilities using Trivy, Snyk, and other security tools diff --git a/commands/container-scan.md b/commands/container-scan.md new file mode 100644 index 0000000..31f5ee9 --- /dev/null +++ b/commands/container-scan.md @@ -0,0 +1,25 @@ +--- +description: $(echo "$description" | cut -d' ' -f1-5) +--- + +# $(echo "$name" | sed 's/-/ /g' | sed 's/\b\(.\)/\u\1/g') + +$(echo "$description") + +## Key Features + +- Production-ready configurations +- Best practices implementation +- Security-first approach +- Scalable architecture +- Comprehensive documentation +- Multi-platform support + +## Example Usage + +This plugin generates complete configurations for your DevOps needs. +Specify your requirements and get production-ready code instantly. + +## When Invoked + +Generate configurations and setup code based on your specific requirements and infrastructure needs. diff --git a/plugin.lock.json b/plugin.lock.json new file mode 100644 index 0000000..b5ff7c3 --- /dev/null +++ b/plugin.lock.json @@ -0,0 +1,61 @@ +{ + "$schema": "internal://schemas/plugin.lock.v1.json", + "pluginId": "gh:jeremylongshore/claude-code-plugins-plus:plugins/devops/container-security-scanner", + "normalized": { + "repo": null, + "ref": "refs/tags/v20251128.0", + "commit": "bf0d418b9a5f4a3337233970302762eae83a8ee9", + "treeHash": "af31d9e6f79c4df423e4a32d2a96f934038b5e7672543c074dff2a9c82257679", + "generatedAt": "2025-11-28T10:18:14.289879Z", + "toolVersion": "publish_plugins.py@0.2.0" + }, + "origin": { + "remote": "git@github.com:zhongweili/42plugin-data.git", + "branch": "master", + "commit": "aa1497ed0949fd50e99e70d6324a29c5b34f9390", + "repoRoot": "/Users/zhongweili/projects/openmind/42plugin-data" + }, + "manifest": { + "name": "container-security-scanner", + "description": "Scan containers for vulnerabilities using Trivy, Snyk, and other security tools", + "version": "1.0.0" + }, + "content": { + "files": [ + { + "path": "README.md", + "sha256": "9f3e32b4fc22e69442c6f6abeca21852ed2e4e135b232c515d236a4a4dd49823" + }, + { + "path": ".claude-plugin/plugin.json", + "sha256": "62b4a2dbcd087d3329a6b4e0aef7adf49ca9fd6d10569483eb54217f195fe86f" + }, + { + "path": "commands/container-scan.md", + "sha256": "353f80054a90cda1e6716da3628115ce829307fbbb83a15b64f1d37c96224a99" + }, + { + "path": "skills/container-security-scanner/SKILL.md", + "sha256": "bfa0063c9bebfd0a9ed0caf31676ac478470bbf1df945e27d2cf29c9ac3e9567" + }, + { + "path": "skills/container-security-scanner/references/README.md", + "sha256": "08e1a6db0fd1cfe26903552e3aaf9ee5747bcd0fe305b3690ef134b8b0931b7f" + }, + { + "path": "skills/container-security-scanner/scripts/README.md", + "sha256": "ed6545231e3f045d88b14b1ee626f62b93d4763d2c49dd2ae920711124cea4ed" + }, + { + "path": "skills/container-security-scanner/assets/README.md", + "sha256": "b46e59914614c0cfcb45a940f3c6665a7e20e9cf555d5ba9736c305f31abec4e" + } + ], + "dirSha256": "af31d9e6f79c4df423e4a32d2a96f934038b5e7672543c074dff2a9c82257679" + }, + "security": { + "scannedAt": null, + "scannerVersion": null, + "flags": [] + } +} \ No newline at end of file diff --git a/skills/container-security-scanner/SKILL.md b/skills/container-security-scanner/SKILL.md new file mode 100644 index 0000000..458e373 --- /dev/null +++ b/skills/container-security-scanner/SKILL.md @@ -0,0 +1,52 @@ +--- +name: scanning-container-security +description: | + This skill enables Claude to scan container images and running containers for vulnerabilities using tools like Trivy and Snyk. It identifies potential security risks in container environments. Use this skill when the user requests a security assessment of a container image, asks to identify vulnerabilities in a container, or wants to improve the security posture of their containerized applications. Trigger terms include "scan container," "container security," "vulnerability assessment," "Trivy scan," or "Snyk scan." +allowed-tools: Read, Write, Edit, Grep, Glob, Bash +version: 1.0.0 +--- + +## Overview + +This skill empowers Claude to perform comprehensive security scans of container images and running containers. By leveraging industry-standard tools, it identifies vulnerabilities and provides insights for remediation, enhancing the overall security of containerized applications. + +## How It Works + +1. **Receiving Request**: Claude receives a user request to scan a container for vulnerabilities. +2. **Executing Scan**: Claude utilizes tools like Trivy or Snyk to perform the security scan on the specified container image or running container. +3. **Reporting Results**: Claude presents a detailed report of identified vulnerabilities, including severity levels and potential remediation steps. + +## When to Use This Skill + +This skill activates when you need to: +- Assess the security of a container image before deployment. +- Identify vulnerabilities in a running container within a production environment. +- Generate a security report for compliance purposes. + +## Examples + +### Example 1: Pre-Deployment Security Check + +User request: "Scan this Docker image for vulnerabilities before I deploy it: myapp:latest" + +The skill will: +1. Initiate a Trivy scan on the `myapp:latest` Docker image. +2. Return a report listing all identified vulnerabilities, their severity, and suggested fixes. + +### Example 2: Runtime Container Security Assessment + +User request: "Scan the running container with ID abc123xyz for security vulnerabilities." + +The skill will: +1. Execute a Snyk scan on the container with ID `abc123xyz`. +2. Provide a report detailing any vulnerabilities found in the running container, along with remediation advice. + +## Best Practices + +- **Specify Image Name**: Always provide the full image name (including tag) for accurate scanning. +- **Review Severity Levels**: Pay close attention to high and critical severity vulnerabilities and address them promptly. +- **Regular Scanning**: Schedule regular container security scans to detect new vulnerabilities as they are discovered. + +## Integration + +This skill can be integrated with other CI/CD pipeline tools to automate security checks as part of the deployment process. It also provides data that can be used with reporting and dashboarding tools to visualize security posture over time. \ No newline at end of file diff --git a/skills/container-security-scanner/assets/README.md b/skills/container-security-scanner/assets/README.md new file mode 100644 index 0000000..92a1ea7 --- /dev/null +++ b/skills/container-security-scanner/assets/README.md @@ -0,0 +1,7 @@ +# Assets + +Bundled resources for container-security-scanner skill + +- [ ] scan_results_template.json: A JSON template for structuring the output of security scans. +- [ ] example_trivy_output.json: Example output from a Trivy scan to guide Claude's parsing. +- [ ] example_snyk_output.json: Example output from a Snyk scan to guide Claude's parsing. diff --git a/skills/container-security-scanner/references/README.md b/skills/container-security-scanner/references/README.md new file mode 100644 index 0000000..2d231c7 --- /dev/null +++ b/skills/container-security-scanner/references/README.md @@ -0,0 +1,8 @@ +# References + +Bundled resources for container-security-scanner skill + +- [ ] trivy_cli_reference.md: Comprehensive documentation of Trivy CLI commands and options. +- [ ] snyk_cli_reference.md: Comprehensive documentation of Snyk CLI commands and options. +- [ ] cis_docker_benchmark.md: CIS Docker Benchmark v1.2.0 documentation. +- [ ] container_security_best_practices.md: A guide to container security best practices. diff --git a/skills/container-security-scanner/scripts/README.md b/skills/container-security-scanner/scripts/README.md new file mode 100644 index 0000000..6874abe --- /dev/null +++ b/skills/container-security-scanner/scripts/README.md @@ -0,0 +1,8 @@ +# Scripts + +Bundled resources for container-security-scanner skill + +- [ ] trivy_scan.sh: Executes Trivy scan on a given container image and outputs results in JSON format. +- [ ] snyk_scan.sh: Executes Snyk scan on a given container image and outputs results in JSON format. +- [ ] container_runtime_check.sh: Checks the container runtime (Docker, containerd, etc.) and its version. +- [ ] cis_benchmark_scan.sh: Executes CIS benchmark scan on the container host.