Trivy offline scanning

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-gemini-3.1-pro-preview/dependency-vulnerability-check/trivy-offline-scanning

Use Trivy for offline vulnerability scanning of dependency files like package-lock.json.From its SKILL.md

Install

npx -y skills add cxcscmu/SkillLearnBench --skill trivy-offline-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.2 KB, 227 tokens by cl100k_base, as published. Nobody here has run it

Trivy Offline Vulnerability Scanning

Trivy can be used to scan dependency files (e.g. package-lock.json) offline without updating its database or querying the network for dependency analysis.

Prerequisites

Trivy installed.
Vulnerability DB present in the Trivy cache directory.

Usage

To scan a file like package-lock.json and output the results as a JSON file, use the following command:

trivy fs --skip-db-update --offline-scan --format json --output trivy-report.json <path-to-file>

Options Explained:

fs: Scan a filesystem path or a specific file.
--skip-db-update: Prevents Trivy from attempting to update the vulnerability database, crucial for offline scanning.
--offline-scan: Prevents Trivy from issuing API requests to identify dependencies.
--format json: Formats the output as JSON for easier programmatic parsing.
--output trivy-report.json: Saves the output to the specified file.

This approach ensures zero network calls during the analysis of dependency manifests.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.