Snyk Security Scanning AI Skill Guide

Overview & Engine Architecture

Snyk scans applications for vulnerable dependencies (Open Source), container images, IaC misconfigs, and optionally code issues. Results flow to the Snyk UI and CI. Agents prioritize reachable/high-severity issues, prefer upgrade paths over endless ignores, and wire gates that match the team's risk appetite.

Manifests / lockfiles / Dockerfiles / IaC
   -> snyk test | monitor | container test | iac test
       -> Vulnerability DB + policy
           -> Fix PRs / ignores / CI fail

When to use this skill

• Adding dependency scanning to repos and pipelines
• Triaging CVEs in npm/pip/maven lockfiles
• Scanning container images before deploy
• Setting org ignore policies with expiry

Operational directives

1. Commit lockfiles; Snyk accuracy depends on resolved trees.
2. Fix by upgrading or replacing packages before ignoring.
3. Ignores need reason + expiry; permanent ignores for highs are exceptional.
4. Use snyk monitor for continuous tracking; snyk test for PR gates.
5. Never paste Snyk tokens into source; use CI secrets.

CLI sketches

snyk auth
snyk test --severity=package-lock.json
snyk test --severity=high --json-file-output=snyk.json
snyk container test myimage:tag
snyk iac test terraform/
snyk ignore --id=SNYK-JS-LODASH-123 --expiry=2026-12-01 --reason="Mitigated by input validation; upgrade blocked"

Triage matrix

Finding	Prefer
Patch version available	Bump lockfile ASAP
Major upgrade breaking	Schedule upgrade epic; temporary ignore with expiry
Dev-only dependency, not shipped	Still fix; lower gate severity if policy allows
False positive / unreachable	Document ignore; link to analysis

Best practices

• Separate app SCA gates from container/IaC projects for clearer ownership.
• Fail PRs on new highs/criticals introduced by the change; baseline debt via backlog.
• Pair with @semgrep/@codeql for first-party code bugs SCA cannot see.
• Rebuild images after base-image fixes; rescanning an old tag is not remediation.

Limitations

• Reachability analysis quality varies by ecosystem and plan features.
• Private registry auth must be configured or scans miss/partial trees.
• License scanning policies are org-specific and may block otherwise "safe" packages.

Related skills

• @dependabot-config - automated dependency PR companion
• @semgrep / @codeql - SAST companions
• @docker - image rebuild and minimal base practices
• @owasp-asvs - map dependency risk into verification evidence