Devcontainer Dev
stacklok/toolhive-studio
Spin up and interact with ToolHive Studio's containerized dev environment (Xvfb + noVNC + DinD).
Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity.
Install Triage Image Cves
$ npx skills add activepieces/activepieces --skill triage-image-cves -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install activepieces/activepieces triage-image-cves --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/activepieces/activepieces.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/triage-image-cves .claude/skills/triage-image-cves && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "triage-image-cves" agent skill from https://github.com/activepieces/activepieces/tree/main/.agents/skills/triage-image-cves into .claude/skills/triage-image-cves/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-image-cves", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/activepieces/activepieces/tree/main/.agents/skills/triage-image-cvesType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add activepieces/activepieces --skill triage-image-cves -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install activepieces/activepieces triage-image-cves --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/activepieces/activepieces.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/triage-image-cves .agents/skills/triage-image-cves && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "triage-image-cves" agent skill from https://github.com/activepieces/activepieces/tree/main/.agents/skills/triage-image-cves into .agents/skills/triage-image-cves/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-image-cves", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add activepieces/activepieces --skill triage-image-cves -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install activepieces/activepieces triage-image-cves --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/activepieces/activepieces.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/triage-image-cves .cursor/skills/triage-image-cves && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "triage-image-cves" agent skill from https://github.com/activepieces/activepieces/tree/main/.agents/skills/triage-image-cves into .cursor/skills/triage-image-cves/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-image-cves", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/activepieces/activepieces.git --path .agents/skills/triage-image-cves--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add activepieces/activepieces --skill triage-image-cves -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install activepieces/activepieces triage-image-cves --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/activepieces/activepieces.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/triage-image-cves .gemini/skills/triage-image-cves && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "triage-image-cves" agent skill from https://github.com/activepieces/activepieces/tree/main/.agents/skills/triage-image-cves into .gemini/skills/triage-image-cves/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-image-cves", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install activepieces/activepieces triage-image-cvesInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add activepieces/activepieces --skill triage-image-cves -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/activepieces/activepieces.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/triage-image-cves .github/skills/triage-image-cves && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "triage-image-cves" agent skill from https://github.com/activepieces/activepieces/tree/main/.agents/skills/triage-image-cves into .github/skills/triage-image-cves/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-image-cves", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add activepieces/activepieces --skill triage-image-cves -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install activepieces/activepieces triage-image-cves --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/activepieces/activepieces.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/triage-image-cves .opencode/skills/triage-image-cves && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "triage-image-cves" agent skill from https://github.com/activepieces/activepieces/tree/main/.agents/skills/triage-image-cves into .opencode/skills/triage-image-cves/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-image-cves", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
triage-image-cves- GitHub stars
- 25k
- Token cost
- ~3.6k tokens
- SKILL.md length
- 1,572 words
- Files
- 1
- Skills in repo
- 14
- Repo updated
- First seen
- Licence
- Custom licence
At a glance
Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity.
- Works in 4 steps: Pick the tag, then scan (deterministic) → Validate each finding (one focused… → Report → …
- The user asks to grype-scan the image
- SKILL.md covers Privacy note, Prerequisites, Step 1 — Pick the tag, then… and Step 2 — Validate each finding…, plus 3 more sections
- Calls jq, docker and git; reaches hub.docker.com
What it does
Triage Image Cves is an agent skill from activepieces/activepieces. Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity. Lists the 3 most-recent published tags and lets the user pick which to scan, validates each finding is real and reachable, and proves candidate fixes in an isolated git worktree (rebuild image + re-scan + tests + container smoke-run + codebase diff) before proposing anything — fixes are NEVER auto-applied; the user decides per finding. Use when the user asks to grype-scan the image, triage…
Its SKILL.md is about 3.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Vulnerability scanning, Containers and Git worktrees. It works with Docker, Git, npm and Model Context Protocol. The repository describes itself as: AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents.
When your agent uses it
- The user asks to grype-scan the image
- Triage container/image vulnerabilities
- Check a shipped Docker image for CVEs
Example prompts
- “/triage-image-cves”
Requirements
- Docker
Workflow steps
4 steps, taken from the step headings in SKILL.md.
- Pick the tag, then scan (deterministic)
- Validate each finding (one focused subagent per package)
- Report
- Fix on approval (PROVEN in an isolated worktree, never applied)
What it can do on your machine
Read from SKILL.md and the folder at commit 566f00e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
jqdockergitbuncurlapkbrewapt-getnpx
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
hub.docker.com
Also links to:
github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Triage Image Cves loads about 3.6k tokens when it runs. Until then it costs about 152 tokens; SKILL.md has 1,572 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 1,572 words (~3,631 tokens).
“On-demand triage of vulnerabilities in a published Activepieces Docker image on Docker Hub (activepieces/activepieces) using grype. The skill lists the 3 most-recent tags and lets the user pick which to scan. Produces a review-ready report per affected package and proposes…”
- name
- triage-image-cves
Files
Just SKILL.md in .agents/skills/triage-image-cves of activepieces/activepieces.
Open the folder on GitHubat commit 566f00e
Compare with similar skills
Triage Image Cves next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Triage Image Cves this skillactivepieces/activepieces | 25k | — | ~3.6k | Automated safety check: Pass | Custom licence | |
| Devcontainer Devstacklok/toolhive-studio | 170 | — | ~3.8k | Automated safety check: Notes | Apache-2.0 | |
| Security Scanbagofwords1/bagofwords | 459 | — | ~1.7k | Automated safety check: Pass | Custom licence | |
| Security Analyzeraiskillstore/marketplace | 430 | — | ~1.2k | Automated safety check: Notes | None | |
| Scanning Containers With Trivy In Cicdmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.7k | Automated safety check: Pass | Apache-2.0 | |
| Performing Container Security Scanning With Trivymukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~818 | Automated safety check: Pass | Apache-2.0 |
Similar skills
Security Scan
bagofwords1/bagofwords
Run a Snyk security scan of the repo (frontend npm deps, backend pip deps, Dockerfile/base image, and Snyk Code SAST), triage findings, and remediate the real ones with verified fixes.
Security Analyzer
aiskillstore/marketplace
Comprehensive security vulnerability analysis for codebases and infrastructure.
Scanning Containers With Trivy In Cicd
mukul975/Anthropic-Cybersecurity-Skills
Integrates Aqua Security's Trivy scanner into CI/CD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and…
Performing Container Security Scanning With Trivy
mukul975/Anthropic-Cybersecurity-Skills
Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed…
Build Px4 macOS
PX4/PX4-Autopilot
Build PX4 board firmware on macOS in the px4-dev Docker container, including git worktrees, and stage commit-labeled artifacts without flashing hardware.
More from activepieces/activepieces
All 14 skills in this repoAnalyze Logs
activepieces/activepieces
Analyze application logs from the .evlog/logs/ directory. An agent skill from activepieces/activepieces.
Activepieces Design System
activepieces/activepieces
Design system for Activepieces (open-source AI automation platform, "open source replacement for Zapier").
Piece Builder
activepieces/activepieces
Build and edit Activepieces pieces (integrations) — creating new pieces, adding actions or triggers, or fixing bugs in existing ones.
Profile App Cpu
activepieces/activepieces
Find what is burning CPU in a live app container without restarting it: separate the JS thread from GC and libuv, open the V8 inspector in place with SIGUSR1, take a CPU profile over CDP, and…
Profile Worker Memory
activepieces/activepieces
Diagnose a worker that is growing memory or being OOM-killed: separate a JS-heap leak from native growth, take a V8 heap snapshot of a live worker in place (never uploading it), and walk the…
Triage Dependabot Alerts
activepieces/activepieces
Triage Dependabot dependency vulnerability alerts for the Activepieces repo — pull open alerts, dedupe to distinct (package, advisory), confirm the vulnerable package + API is actually used, and…
Related
Works with
Categories
Questions about Triage Image Cves
What does Triage Image Cves do?
Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity. Triage Image Cves is an agent skill from activepieces/activepieces. Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity.
When should I use Triage Image Cves?
Triage Image Cves fits situations like: the user asks to grype-scan the image; triage container/image vulnerabilities; check a shipped Docker image for CVEs.
How do I install Triage Image Cves in Claude Code?
Run `npx skills add activepieces/activepieces --skill triage-image-cves -a claude-code`. Or copy the skill folder (.agents/skills/triage-image-cves in activepieces/activepieces) into .claude/skills/triage-image-cves in your project. Claude Code loads it when a task matches its description.
How do I install Triage Image Cves in Codex?
Run `npx skills add activepieces/activepieces --skill triage-image-cves -a codex`. Or copy the skill folder (.agents/skills/triage-image-cves in activepieces/activepieces) into .agents/skills/triage-image-cves in your project. Codex loads it when a task matches its description.
Can I use Triage Image Cves in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add activepieces/activepieces --skill triage-image-cves -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/triage-image-cves, .gemini/skills/triage-image-cves, .github/skills/triage-image-cves and .opencode/skills/triage-image-cves in your project.
What does Triage Image Cves need to run?
Going by SKILL.md and its folder, Triage Image Cves needs the command-line tools its instructions call (jq, docker, git, bun, curl and apk). Our summary lists: Docker.
Does Triage Image Cves access the network?
SKILL.md names 2 domains. In commands or code: hub.docker.com; the agent is likely to contact it when it follows the instructions. As links in the text: github.com. This is read from the text; nothing was executed.
Is Triage Image Cves safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Triage Image Cves use?
Triage Image Cves has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
How many tokens does Triage Image Cves use?
About 3.6k tokens (SKILL.md is roughly 15k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Triage Image Cves?
Skills that share tags, products or a category with Triage Image Cves: Devcontainer Dev (stacklok/toolhive-studio, 170 stars), Security Scan (bagofwords1/bagofwords, 459 stars), Security Analyzer (aiskillstore/marketplace, 430 stars) and Scanning Containers With Trivy In Cicd (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Triage Image Cves?
activepieces (a GitHub organization) maintains it in activepieces/activepieces, which has 24,961 GitHub stars. The repository holds 14 skills in this directory. The repository was last updated on October 9, 2026.
Source: activepieces/activepieces on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.