Trivy offline vulnerability scanning

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-claude-sonnet-4-6/dependency-vulnerability-check/trivy-offline-vulnerability-scanning

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill trivy-offline-vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files without internet access.

SKILL.md

2.1 KB, as published. Nobody here has run it

Trivy Offline Vulnerability Scanning

Setup

Trivy requires a pre-downloaded vulnerability database for offline scanning.

Check database exists:

ls /root/trivy-cache/db/
# Should show: trivy.db  metadata.json

Key Flags

Flag	Purpose
`fs <target>`	Scan a file or directory
`--format json`	JSON output for parsing
`--output <file>`	Save results to file
`--scanners vuln`	Only vulnerability scanning
`--skip-db-update`	Do not update database (offline)
`--offline-scan`	Enable offline mode
`--cache-dir <path>`	Path to offline database
`--severity HIGH,CRITICAL`	Filter by severity

Usage

import subprocess, os, sys

def run_trivy_offline_scan(target_file, output_file, cache_dir='/root/trivy-cache'):
    db_path = os.path.join(cache_dir, "db", "trivy.db")
    if not os.path.exists(db_path):
        print(f"[!] Database not found at {db_path}")
        sys.exit(1)

    command = [
        "trivy", "fs", target_file,
        "--format", "json",
        "--output", output_file,
        "--scanners", "vuln",
        "--skip-db-update",
        "--offline-scan",
        "--cache-dir", cache_dir
    ]

    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        print(result.stderr)
        sys.exit(1)
    return output_file

JSON Output Structure

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-44906",
          "PkgName": "minimist",
          "InstalledVersion": "1.2.5",
          "FixedVersion": "1.2.6",
          "Severity": "CRITICAL",
          "Title": "Prototype Pollution in minimist",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44906",
          "CVSS": { "nvd": { "V3Score": 9.8 } }
        }
      ]
    }
  ]
}