container-scan

# Vulnetix Container Scan Skill ## Use when - Pre-build: scan a Dockerfile for misconfigurations and base-image CVEs. - PR review: detect EOL base images, missing USER, root processes, exposed secrets. - `--image registry/img:tag`: scan a built image for installed-package CVEs via Trivy/Grype if available. - Compose with Syft to produce a container SBOM (CycloneDX JSON). - Hardening checklist: USER directive present, healthcheck defined, pinned versions, layer minimisation. ## Don't use for - Source-code SAST — use `/vulnetix:sast-scan`. - Cloud-config (Terraform / k8s manifests) — use `/vulnetix:iac-scan`. - Vulnetix CLI itself does not pull images; for `--image` you need `binaries.docker` or `binaries.podman`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Note: `binaries.{docker,podman,trivy,grype,syft}`, `repo.{dockerfile,containerfile,compose,docker_compose}`. If no container artifacts found AND no `--image` argument, abort with a one-liner. ## Step 2: Run Vulnetix container analysis ```bash vulneti...