anchore/grype ? reverse-engineered prompt

Build me a Go command line tool that scans container images, local folders, and SBOM files for known security vulnerabilities.

I want it to be easy to run from the terminal, like scanning an image name, a directory on disk, or a JSON SBOM and then printing a clear report of the findings. It should understand common Linux package systems and also language packages, and it should work with Docker and OCI style images. Please include useful prioritization in the results, like flagging higher risk issues more clearly when there is known exploitability or existing threat intel. It would also be great if the scanner can filter or adjust results using OpenVEX style data.

Make it feel like a real security tool people can use right away, with sensible defaults, helpful output, and a clean way to configure it. If you need to check current docs or package details online, go ahead and do that.