Trivy offline scanning

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-gemini-3.1-pro-preview/dependency-vulnerability-check/trivy-offline-scanning

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill trivy-offline-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use Trivy for offline vulnerability scanning of dependency files like package-lock.json.

SKILL.md

1.2 KB, as published. Nobody here has run it

Trivy Offline Vulnerability Scanning

Trivy can be used to scan dependency files (e.g. package-lock.json) offline without updating its database or querying the network for dependency analysis.

Prerequisites

Trivy installed.
Vulnerability DB present in the Trivy cache directory.

Usage

To scan a file like package-lock.json and output the results as a JSON file, use the following command:

trivy fs --skip-db-update --offline-scan --format json --output trivy-report.json <path-to-file>

Options Explained:

fs: Scan a filesystem path or a specific file.
--skip-db-update: Prevents Trivy from attempting to update the vulnerability database, crucial for offline scanning.
--offline-scan: Prevents Trivy from issuing API requests to identify dependencies.
--format json: Formats the output as JSON for easier programmatic parsing.
--output trivy-report.json: Saves the output to the specified file.