trivy

Find vulnerabilities, misconfigurations, and secrets in containers and code

workhorse Go aquasecurity/trivy
78% pass rate
3/8 principles met

Spec Coverage

How many of the spec's requirements were verified for this tool. See /coverage for the full matrix.

LevelTotalVerifiedUnverified
MUST28199
SHOULD21138
MAY10100

Top Issues

All Audits

P1: Non-Interactive by Default

PASSNon-interactive by default
SKIPNon-interactive gate flag advertised in --helptarget satisfies P1 via alternative gate (help-on-bare or stdin-primary)
WARNFlags advertise env-var bindings in --help11 flag(s) found in --help but no `[env: NAME]` bindings advertised
PASSSecret-bearing flags expose stdin or *-file companion
WARN`--help` advertises default values for flagsno default-value annotations found in --help. SHOULD-tier — agents reading help text need to see what value a flag falls back to when omitted (`[default: <value>]` per clap convention).
PASSRich-TUI affordance for TTY contexts

P2: Structured, Parseable Output

PASSStructured output support
FAILStructured-output CLI exposes its schema at runtimeCLI emits structured output but exposes no `schema` subcommand or `--schema` flag at top level or nested one level deep. Agents need a runtime-discoverable schema to pin against shape changes.
WARN--json / --jsonl short aliases for --outputno --json or --jsonl short alias found. Agents and pipelines benefit from short forms alongside the canonical `--output` enum.
WARN`--raw` flag for pipe-safe unformatted outputno `--raw` flag advertised. MAY-tier — useful for pipelines that want to strip formatting before piping to other tools.
PASS`--output` advertises additional formats beyond text/json
WARNBad invocation exits with structured usage-error code (2)bad invocation exited with code 1. The 0/1/2/77/78 convention reserves code 2 for usage errors; using a different non-zero code (often 1) blurs the distinction between usage errors and general failure.
SKIPErrors emit JSON envelope with `error`/`kind`/`message` under `--output json`binary does not advertise `--output json` in --help; MUST applies only to CLIs that opt into the JSON contract.
SKIPJSON success and error envelopes share their non-payload key setbinary does not advertise `--output json` in --help; envelope-consistency only applies to CLIs that opt into the JSON contract.

P3: Progressive Help Discovery

PASSHelp flag produces useful output
PASSVersion flag works (`--version` plus short alias)
PASSVersion flag works (`--version` plus short alias)
WARN`examples` subcommand or `--examples` flag for curated usage patternsno `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text.
WARNShort `-h` summary differs from `--help` long form`-h` and `--help` produce byte-identical output. SHOULD-tier — clap renders the short summary on `-h` and the full description on `--help` when `long_about` is set; collapsing them gives agents no concise list-level grep target.
SKIPEach subcommand's `--help` ships at least one invocation examplebinary has no subcommands; MUST applies conditionally to CLIs that use them.
WARNHelp text pairs human and `--output json` example invocationsno paired text + `--output json` example found within 5 lines in top-level or any subcommand `--help`. Pairing keeps agents from reverse-engineering the JSON invocation from the text one.

P4: Fail-Fast, Actionable Errors

PASSRejects invalid arguments
PASSError messages include a hint or remediation phrase
SKIP`--output json` produces JSON-formatted errorsbinary does not advertise `--output json` in --help; SHOULD applies only to CLIs that opt into the JSON contract.

P5: Safe Retries & Mutation Boundaries

SKIPDestructive subcommands require `--force` or `--yes`no destructive subcommands detected; MUST applies conditionally to CLIs with destructive operations.
SKIPRead and write surfaces are both visible in subcommand listno recognizable read or write subcommand verbs; the read/write distinction is unobservable from the help surface alone.

P6: Composable, Predictable Command Structure

PASSHandles SIGPIPE gracefully
WARNPager-using CLI ships --no-pager escape hatchpager referenced in --help but no --no-pager escape hatch advertised
PASSRespects NO_COLOR
SKIPSubcommand verbs follow community-standard namesno subcommands parsed from --help
WARN`--color` flag for explicit color controlno `--color` flag advertised. MAY-tier — `auto|always|never` lets agents and pipelines override the TTY-based default.
SKIPInput-accepting commands read from stdin when no file is givenno input-accepting subcommand detected (process/parse/convert/transform/analyze/validate/format/lint/audit); vacuous skip for the conditional SHOULD.
SKIPSubcommand naming follows a consistent verb/noun conventionfewer than 2 user-defined subcommands; vacuous skip for the conditional SHOULD.
PASSOperations are subcommands, not verb-shaped flags

P7: Bounded, High-Signal Responses

PASSQuiet mode available
PASS`--verbose` flag for diagnostic escalation
SKIP`--limit` / `--max-results` flag for list operationsno list-style subcommand detected (list/ls/search/query/find/show/get); vacuous skip for the list-only SHOULD.
SKIPCursor-based pagination flags for list traversalno list-style subcommand detected; vacuous skip for the list-only MAY.
SKIP`--timeout` flag for long-running operationsno long-running subcommand detected (serve/daemon/watch/tail/monitor/follow/run/start/stream); vacuous skip for the conditional SHOULD.
WARNHelp text advertises TTY-aware verbosity behaviorno TTY-aware language found in `--help`. MAY-tier — automatic verbosity reduction when stdout is piped or redirected lets agents skip the explicit `--quiet` flag. Behavioral probes cannot simulate a real TTY without a pty crate, so this audit relies on documented intent.

P8: Discoverable Through Agent Skill Bundles

PASSSkill bundle has install path (`tool skill install [<host>]`)
PASS`skill install --all` for multi-runtime install
PASS`skill update` / `skill upgrade` for bundle refresh

Details

Version scored
0.71.0
Audit date
2026-06-01 17:35:43 UTC
Duration
524ms
Platform
linux/x86_64
Mode
command
Anc build
0.5.0
Install
brew install trivy

Embed the badge

This score (78%) clears the badge floor (70%). Copy this into your README:

[![agent-native](https://anc.dev/badge/trivy.svg)](https://anc.dev/score/trivy)

Preview: agent-native badge for trivy

Reproduce this scorecard for trivy locally and inspect the failing audits:

anc audit --command trivy --output json

Install anc first if you don't have it. Add --output json to get the same JSON shape committed under scorecards/.