diff --git a/.github/workflows/guard-skills.yml b/.github/workflows/guard-skills.yml
index a9e9f419..50fad95e 100644
--- a/.github/workflows/guard-skills.yml
+++ b/.github/workflows/guard-skills.yml
@@ -4,11 +4,12 @@ on:
   pull_request:
     paths:
       - 'skills/**'
-      - '!skills/README.md'
       - 'providers/claude/plugin/skills/**'
       - 'providers/codex/plugin/skills/**'
       - 'providers/cursor/plugin/skills/**'
       - 'providers/grok/plugin/skills/**'
+    paths-ignore:
+      - 'skills/README.md'
 
 jobs:
   block:
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
new file mode 100644
index 00000000..883d9c82
--- /dev/null
+++ b/.github/workflows/trivy-scan.yml
@@ -0,0 +1,29 @@
+name: Trivy security scan
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  trivy-scan:
+    name: Trivy filesystem scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@v0.2.0
+        with:
+          scan-type: fs
+          format: table
+          severity: CRITICAL,HIGH,MEDIUM
+
+      - name: Show summary (always)
+        if: always()
+        run: |
+          echo "Trivy step finished. Check the job log for details."
diff --git a/docs/trivy-integration.md b/docs/trivy-integration.md
new file mode 100644
index 00000000..e15d2173
--- /dev/null
+++ b/docs/trivy-integration.md
@@ -0,0 +1,16 @@
+Trivy integration (quick start)
+
+This repository now includes a GitHub Actions job (.github/workflows/trivy-scan.yml) that runs Trivy filesystem scans on pushes to main and on pull requests.
+
+Run locally (Docker):
+
+- Scan the repo directory and produce a table report:
+  docker run --rm -v "$(pwd)":/project aquasecurity/trivy:latest fs --severity CRITICAL,HIGH,MEDIUM -f table /project
+
+- Output JSON for further processing:
+  docker run --rm -v "$(pwd)":/project aquasecurity/trivy:latest fs --severity CRITICAL,HIGH,MEDIUM -f json -o /project/trivy-report.json /project
+
+CI notes:
+- The action used is aquasecurity/trivy-action; check job logs for scan output.
+- Adjust 'severity' in .github/workflows/trivy-scan.yml to change which severities trigger reporting.
+- For faster scans in CI, consider caching or targetting only changed files/directories.
diff --git a/skills/test-trigger.txt b/skills/test-trigger.txt
new file mode 100644
index 00000000..fb39ec48
--- /dev/null
+++ b/skills/test-trigger.txt
@@ -0,0 +1 @@
+This is a test to trigger guard-skills workflow. Please ignore.