Trivy offline vulnerability scanning

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-claude-opus-4-6/dependency-vulnerability-check/trivy-offline-vulnerability-scanning

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill trivy-offline-vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files.

SKILL.md

1.7 KB, as published. Nobody here has run it

Trivy Offline Vulnerability Scanning

Overview

Trivy is a comprehensive security scanner that can detect vulnerabilities in OS packages and application dependencies. In offline mode, it uses a pre-downloaded vulnerability database.

Key Commands

Scan a package-lock.json file (offline, JSON output)

trivy fs --skip-db-update --skip-java-db-update \
  --format json \
  --scanners vuln \
  --pkg-types library \
  --severity HIGH,CRITICAL \
  /path/to/package-lock.json

Important Flags

--skip-db-update: Use the already-downloaded DB (offline mode)
--skip-java-db-update: Skip Java DB update for non-Java projects
--format json: Machine-readable output for downstream processing
--severity HIGH,CRITICAL: Filter by severity level
--scanners vuln: Only scan for vulnerabilities (skip misconfig, secret, etc.)
--pkg-types library: Scan application libraries only

Output Structure (JSON)

The JSON output contains a Results array. Each result has:

Target: the scanned file
Vulnerabilities: array of vulnerability objects with fields:
- PkgName: package name
- InstalledVersion: installed version
- VulnerabilityID: CVE ID (e.g., CVE-2023-1234)
- Severity: HIGH, CRITICAL, etc.
- CVSS: object with scoring from multiple sources (nvd, ghsa, redhat)
- FixedVersion: version that fixes the vulnerability (may be empty)
- Title: short vulnerability title
- PrimaryURL: reference URL
- Description: longer description (use if Title is empty)