Borrowing it
Nothing to install: this file belongs to broadinstitute/viral-ngs. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/broadinstitute/viral-ngs/main/.agents/skills/container-vulns/SKILL.mdgit clone --depth 1 https://github.com/broadinstitute/viral-ngsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/broadinstitute/viral-ngs/container-vulns)<a href="https://agentmods.dev/skills/broadinstitute/viral-ngs/container-vulns"><img src="https://agentmods.dev/badge/skills/broadinstitute/viral-ngs/container-vulns/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/broadinstitute/viral-ngs/container-vulns"><img src="https://agentmods.dev/badge/skills/broadinstitute/viral-ngs/container-vulns.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 29 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02619 |
| Opus 5 | $0.00000 | $0.01309 |
| Sonnet 5 | $0.00000 | $0.00524 |
| Haiku 4.5 | $0.00000 | $0.00262 |
Grade A, and why
container-vulns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Container Vulnerability Management
Guidance for scanning, triaging, and mitigating container image vulnerabilities in the viral-ngs Docker image hierarchy.
Scanning
Container images are scanned for vulnerabilities using Trivy:
PR/Push Scans (docker.yml)
- Runs on every PR/push after image build
- SARIF scan: CRITICAL/HIGH, fixable-only → uploads to GitHub Security tab
- JSON scan: CRITICAL/HIGH, fixable-only, exit-code: 1 → gates CI (fails if CVEs found)
- Both apply
.trivyignore.yamland.trivy-ignore-policy.rego
Scheduled Scans (container-scan.yml)
- Runs daily at 09:00 UTC on published
main-mega-amd64image - SARIF scan: CRITICAL/HIGH, fixable-only → uploads to GitHub Security tab
- JSON scan: CRITICAL/HIGH/MEDIUM, all vulnerabilities (fixable + non-fixable), exit-code: 0 → uploaded as artifact for comprehensive debugging and Claude analysis
- When new fixable HIGH/CRITICAL CVEs are detected (i.e. CVE IDs not already present in any open or closed GH issue title), the workflow invokes Claude Sonnet 5 on Vertex AI to triage each one and files a GitHub issue per CVE (labels:
security,cve) - Auto-fix PR (
cve-fix-prjob): after new issues are filed, Claude assesses all currently-opencveissues and either opens a singlecve-fix+securityPR — only if every open issue meets the moderate confidence bar (version-floor bump, precedent-mirroring Dockerfile mitigation, or precedent-mirroring.trivyignore.yamlentry; all-or-nothing) — or uploads aSKIPPED.mddecision-log artifact. The PR is authored with a GitHub App token so it triggers the required CI checks. - Recovery / manual re-run: the auto-fix job only fires when the scan finds a new CVE, so once an issue is filed the CVE is no longer "new" and a failed or skipped fix run will not retry on its own. To re-run it on demand against all currently-open
cveissues, dispatch manually:gh workflow run container-scan.yml -f force_fix_pr=true - Conda availability probe: both Claude steps are preceded by
.github/scripts/probe-conda-availability.py, which queries the conda-forge and bioconda APIs and writes.cve-fix-context/conda-availability.json. Per affected package it reports whether the TrivyFixedVersionexists on a channel, whether it is built for bothlinux-64andlinux-aarch64(or isnoarch), whether a requirements pin can fix the finding at all (fix_shape— an Ubuntuos-packageor abundled-jarcannot), and which other pinned packages carry a constraint that would exclude the fix version (constrained_by, e.g.pyopenssl<50cappingcryptography). Uploaded as a workflow artifact. Before this existed the agents had no network tool at all and skipped every version-floor bump as unverifiable — the primary category the pipeline was built for. - CI verifies ARM64, so the agent does not have to:
docker.ymlbuilds all six tiers for both amd64 and native arm64 on every PR and re-scans each with Trivy, so a solver conflict from a floor bump fails required checks before merge. The auto-fix prompt says so explicitly and instructs the agent to reserve SKIP for "I cannot determine what the fix is", not "I cannot prove the fix works". Unproven solvability used to be the standard reason for skipping. - Steering the bot via issue comments: maintainer comments on a
cveissue are passed to the auto-fix agent and outrank the machine-generated issue body — use them to specify or amend a fix. Comments are hard-filtered toOWNER/MEMBER/COLLABORATORin the workflow'sjq, not in the prompt: this is a public repo, so an unfiltered comments array would be an untrusted-instruction channel into an agent that edits files and opens PRs. - Agent guardrails: the auto-fix agent has domain-scoped
WebFetch(noWebSearch, since its output is committed); the staged diff is checked against a path allowlist (docker/requirements/*.txt,docker/Dockerfile.*,.trivyignore.yaml) before commit; and the GitHub App token is kept out of.git/configwhile the agent runs (persist-credentials: false, push remote attached afterwards). The triage agent getsWebSearchtoo — it cannot edit or push. - The Vertex/WIF infra used here is documented in
.agents/skills/claude-on-vertex-ci/SKILL.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 110 lines · 0 tokens per session scan A 3c595a9c768a
container-vulns is a skill published in the GitHub repository broadinstitute/viral-ngs (197 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,619 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
repro-enforcer
Export any bioinformatics analysis as a reproducible bundle with Conda environment, Singularity container definition, and Nextflow pipeline.
docker-apptainer-singularity-starter
Use this starter when a task lands in the Docker / Apptainer / Singularity frontier leaf and the repository has curated resources but no dedicated runtime implementation yet.
deploy-docker-compose
Run the Omnigent server as a Docker compose stack (server + Postgres) on any Docker host — your laptop, a VPS, EC2 by hand, or as the base layer of any container-platform deploy. Invoke when the user wants to build the image, bring up the compose stack, debug the stack on a host they already have, or extend the stack…
securing-kubernetes-on-cloud
This skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring. It addresses cloud-specific security features including IRSA for EKS, Workload Identity for…
detecting-privilege-escalation-in-kubernetes-pods
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
implementing-rbac-hardening-for-kubernetes
Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.