oci-cve-checker
starsforks
How to install oci-cve-checker?
opendatahub-io/ai-helpers/oci-cve-checker
$npx -y skills add opendatahub-io/ai-helpers --skill oci-cve-checkerUse this skill to compare CVE vulnerabilities between two OCI container images and generate reports showing fixed and new CVEs.
SKILL.md
| 1 | # OCI CVE Checker |
| 2 | |
| 3 | This skill compares CVE vulnerabilities between two OCI container images and generates detailed reports showing which CVEs were fixed and which new CVEs were introduced. |
| 4 | |
| 5 | ## Instructions |
| 6 | |
| 7 | When a user asks to compare CVEs between container images or analyze security differences: |
| 8 | |
| 9 | 1. **Check and install required dependencies**: |
| 10 | ```bash |
| 11 | ./scripts/manage_deps.sh |
| 12 | ``` |
| 13 | This script checks for trivy, jq, and skopeo, and automatically installs any missing tools to a temporary directory if needed. |
| 14 | |
| 15 | 2. **Run the CVE comparison script** with two container image references: |
| 16 | ```bash |
| 17 | ./scripts/check_cves.sh <base_image> <target_image> [output_directory] |
| 18 | ``` |
| 19 | |
| 20 | 3. **Analyze the generated output files**: |
| 21 | |
| 22 | ### Output Files |
| 23 | The script generates the following files in the output directory (default: `./cve-reports/`): |
| 24 | |
| 25 | - **`fixed_cves.txt`**: CVEs that existed in the base image but are fixed in the target image |
| 26 | - **`new_cves.txt`**: New CVEs that appear in the target image but weren't in the base image |
| 27 | - **`common_cves.txt`**: CVEs that exist in both images |
| 28 | - **`summary.txt`**: High-level summary with counts and statistics |
| 29 | - **`<image_name>_<digest>.json`**: Complete vulnerability scans for each image (filenames include image name and first 12 characters of digest, e.g., `python-3.11_a1b2c3d4e5f6.json`) |
| 30 | |
| 31 | 4. **Interpret the results** for the user: |
| 32 | |
| 33 | ### Fixed CVEs Analysis |
| 34 | - Count of CVEs resolved between versions |
| 35 | - Severity breakdown of fixed vulnerabilities |
| 36 | - Notable security improvements |
| 37 | - Packages that were updated to fix vulnerabilities |
| 38 | |
| 39 | ### New CVEs Analysis |
| 40 | - Count of newly introduced CVEs |
| 41 | - Severity assessment of new vulnerabilities |
| 42 | - Risk evaluation for production deployment |
| 43 | - Packages introducing new vulnerabilities |
| 44 | - Recommendations for mitigation |
| 45 | |
| 46 | ### Overall Security Posture |
| 47 | - Net change in vulnerability count |
| 48 | - Severity trends (more/fewer critical CVEs) |
| 49 | - Recommendation on whether to upgrade |
| 50 | - Additional security considerations |
| 51 | |
| 52 | ## Usage Examples |
| 53 | |
| 54 | ### Compare Two Container Images |
| 55 | ```bash |
| 56 | ./scripts/check_cves.sh registry.io/app:v1.0 registry.io/app:v1.1 |
| 57 | ``` |
| 58 | **Interpretation**: Compare CVEs between version 1.0 and 1.1, identifying security improvements and any regressions. |
| 59 | |
| 60 | ### Compare with Custom Output Directory |
| 61 | ```bash |
| 62 | ./scripts/check_cves.sh quay.io/myapp:latest quay.io/myapp:dev ./security-audit |
| 63 | ``` |
| 64 | **Interpretation**: Generate comparison reports in a custom directory for documentation or CI/CD integration. |
| 65 | |
| 66 | ### Compare Different Registries |
| 67 | ```bash |
| 68 | ./scripts/check_cves.sh docker.io/library/python:3.11 docker.io/library/python:3.12 |
| 69 | ``` |
| 70 | **Interpretation**: Analyze security differences between Python base image versions. |
| 71 | |
| 72 | ### Private Registry Authentication |
| 73 | ```bash |
| 74 | # Method 1: Using auth.json file (Recommended) |
| 75 | REGISTRY_AUTH_FILE=/home/default/containers/auth.json \ |
| 76 | ./scripts/check_cves.sh private-registry.io/app:v1 private-registry.io/app:v2 |
| 77 | |
| 78 | # Method 2: Using environment variables |
| 79 | TRIVY_USERNAME=myuser TRIVY_PASSWORD=mypass \ |
| 80 | ./scripts/check_cves.sh private-registry.io/app:v1 private-registry.io/app:v2 |
| 81 | |
| 82 | # Method 3: Trivy automatically uses podman credentials from ${XDG_RUNTIME_DIR}/containers/auth.json |
| 83 | podman login private-registry.io |
| 84 | ./scripts/check_cves.sh private-registry.io/app:v1 private-registry.io/app:v2 |
| 85 | |
| 86 | # Method 4: For non-SSL registries |
| 87 | TRIVY_NON_SSL=true REGISTRY_AUTH_FILE=/home/default/containers/auth.json \ |
| 88 | ./scripts/check_cves.sh insecure-registry.io/app:v1 insecure-registry.io/app:v2 |
| 89 | ``` |
| 90 | **Interpretation**: Trivy can authenticate to private registries using the REGISTRY_AUTH_FILE environment variable pointing to your auth.json, or using TRIVY_USERNAME/TRIVY_PASSWORD environment variables, or existing podman credentials. |
| 91 | |
| 92 | ## Key Analysis Points |
| 93 | |
| 94 | ### When Reviewing Fixed CVEs |
| 95 | - **Critical/High Severity Fixes**: Highlight major security improvements |
| 96 | - **Long-standing Vulnerabilities**: Note fixes for older, known issues |
| 97 | - **Completeness**: Check if all expected CVEs were addressed |
| 98 | - **Verification**: Confirm fixes align with release notes |
| 99 | |
| 100 | ### When Reviewing New CVEs |
| 101 | - **Severity Assessment**: Prioritize by CVSS score and exploitability |
| 102 | - **Exposure Analysis**: Determine if vulnerable code paths are reachable |
| 103 | - **Mitigation Options**: Suggest workarounds if immediate fix isn't available |
| 104 | - **Timeline**: Check if patches are available or planned |
| 105 | |
| 106 | ### Security Recommendations |
| 107 | |
| 108 | Based on the comparison, provide guidance: |
| 109 | |
| 110 | #### For Improved Security (More Fixed than New) |
| 111 | - "Upgrading is recommended - net reduction of X vulnerabilities" |
| 112 | - "Y critical CVEs fixed with only Z new low-severity issues" |
| 113 | - "Security posture improved, safe to deploy after testing" |
| 114 | |
| 115 | #### For Degraded Security (More New than Fixed) |
| 116 | - "Cau |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
