Trivy offline vulnerability scanning
Use Trivy in offline mode to scan dependency files for security vulnerabilities without requiring internet access.From its SKILL.md
npx -y skills add cxcscmu/SkillLearnBench --skill trivy-offline-vulnerability-scanningAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
SKILL.md
1.4 KB, 310 tokens by cl100k_base, as published. Nobody here has run it
Trivy Offline Vulnerability Scanning
Trivy can be used to scan package manager lock files (like package-lock.json, yarn.lock, Cargo.lock) in offline mode by utilizing a pre-downloaded vulnerability database.
Prerequisites
- Trivy binary installed and available in the PATH.
- A local Trivy database (typically located in
~/.cache/trivy/db).
Usage Pattern
To perform an offline scan of a filesystem path and output the results in JSON format:
trivy fs --offline-scan --format json --output report.json <path_to_file_or_dir>
Filtering by Severity
While you can filter in the command line using --severity, it's often better to get the full report and filter during processing to ensure no data is lost for further analysis.
trivy fs --offline-scan --severity HIGH,CRITICAL --format json <path>
JSON Report Structure
The JSON output contains a Results array. Each element in Results corresponds to a target (e.g., a file) and contains a Vulnerabilities array.
Each vulnerability object typically includes:
VulnerabilityID(e.g., CVE-2023-1234)PkgNameInstalledVersionFixedVersionPrimaryURLTitleDescriptionSeverityCVSS(a map of sources to CVSS scores)
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.