Trivy offline vulnerability scanning
[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.
npx -y skills add cxcscmu/SkillLearnBench --skill trivy-offline-vulnerability-scanningAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Use Trivy in offline mode to scan dependency files for security vulnerabilities without requiring internet access.
SKILL.md
1.4 KB, as published. Nobody here has run it
Trivy Offline Vulnerability Scanning
Trivy can be used to scan package manager lock files (like package-lock.json, yarn.lock, Cargo.lock) in offline mode by utilizing a pre-downloaded vulnerability database.
Prerequisites
- Trivy binary installed and available in the PATH.
- A local Trivy database (typically located in
~/.cache/trivy/db).
Usage Pattern
To perform an offline scan of a filesystem path and output the results in JSON format:
trivy fs --offline-scan --format json --output report.json <path_to_file_or_dir>
Filtering by Severity
While you can filter in the command line using --severity, it's often better to get the full report and filter during processing to ensure no data is lost for further analysis.
trivy fs --offline-scan --severity HIGH,CRITICAL --format json <path>
JSON Report Structure
The JSON output contains a Results array. Each element in Results corresponds to a target (e.g., a file) and contains a Vulnerabilities array.
Each vulnerability object typically includes:
VulnerabilityID(e.g., CVE-2023-1234)PkgNameInstalledVersionFixedVersionPrimaryURLTitleDescriptionSeverityCVSS(a map of sources to CVSS scores)