---
name: "grype-container-sbom-scanner"
description: "Scan container images and SBOM files for known CVEs at lightning speed with Grype."
metadata:
  author: "Anchore"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "scan sbom for cves grype"
  - "find container vulnerabilities grype"
  - "fail build on critical cve grype"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Grype Fast Vulnerability Matching Against SBOMs

Scans container filesystems and Syft SBOMs with Anchore Grype: querying CVE databases, scoring CVSS vulnerabilities, filtering fixed issues, and failing builds on critical findings.

## When to Invoke
Invoke this skill whenever you need to:
- scan sbom for cves grype
- find container vulnerabilities grype
- fail build on critical cve grype

## Execution SOP & Rules
1. Execute grype sbom:sbom.json --fail-on critical to enforce zero-critical CVE gates.
2. Use --only-fixed flag to focus developer remediation on actionable, patchable vulnerabilities.
3. Update local vulnerability database before scanning with grype db update.
4. Archive vulnerability scan reports as compliance evidence for security audits.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.