Trivy vulnerability scanning

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-claude-haiku-4-5/dependency-vulnerability-check/trivy-vulnerability-scanning

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill trivy-vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use Trivy vulnerability scanner in offline mode to detect CVEs in npm dependencies and generate structured JSON reports.

SKILL.md

2.9 KB, as published. Nobody here has run it

Trivy Vulnerability Scanning

Overview

Trivy is a simple, comprehensive vulnerability scanner that can analyze npm package-lock.json files for known security vulnerabilities. It works offline with a local vulnerability database.

Installation

# Install Trivy
apt-get update && apt-get install -y trivy

# Verify installation
trivy --version

Database Setup

Trivy requires a vulnerability database. For offline mode:

# Download the vulnerability database
trivy image download-db --severity HIGH,CRITICAL

# Or let Trivy auto-download on first use
trivy config /root/package-lock.json

Scanning Modes

Scan package-lock.json

trivy config /root/package-lock.json \
  --format json \
  --output results.json \
  --severity HIGH,CRITICAL

Scan Options

--format json: Output JSON format (best for parsing)
--severity HIGH,CRITICAL: Only HIGH and CRITICAL vulnerabilities
--output file.json: Write to file
--offline-db: Use offline database if downloaded
--skip-update: Skip database update (offline mode)

Output Structure

Trivy JSON output contains:

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Type": "npm",
      "Misconfigurations": null,
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-12345",
          "PkgName": "lodash",
          "InstalledVersion": "4.17.20",
          "FixedVersion": "4.17.21",
          "Severity": "HIGH",
          "Title": "Prototype pollution",
          "Description": "...",
          "References": ["https://nvd.nist.gov/vuln/detail/CVE-2021-12345"]
        }
      ]
    }
  ]
}

Parsing Results

import json

def parse_trivy_results(json_file):
    with open(json_file, 'r') as f:
        data = json.load(f)

    vulnerabilities = []
    for result in data.get('Results', []):
        for vuln in result.get('Vulnerabilities', []):
            if vuln['Severity'] in ['HIGH', 'CRITICAL']:
                vulnerabilities.append({
                    'package': vuln['PkgName'],
                    'version': vuln['InstalledVersion'],
                    'cve_id': vuln['VulnerabilityID'],
                    'severity': vuln['Severity'],
                    'title': vuln['Title'],
                    'fixed_version': vuln.get('FixedVersion', 'N/A'),
                    'references': vuln.get('References', [])
                })

    return vulnerabilities

Usage

Use this skill when:

Scanning npm package-lock.json for vulnerabilities
Need offline vulnerability detection
Building security audit pipelines
Filtering for specific severity levels

Related Skills

cvss-score-extraction: Extract CVSS scores for detected vulnerabilities
security-audit-csv-reporting: Convert results to CSV format