agentsclimarketplace

Run2 trivy offline

Skill cxcscmu/SkillLearnBench/skills/b2-self-feedback-gemini-3-flash-preview/dependency-vulnerability-check/run2_trivy-offline

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install
npx -y skills add cxcscmu/SkillLearnBench --skill run2_trivy-offline

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Optimized Trivy offline scanning for lock files, including all dependency types.

SKILL.md

0.8 KB, as published. Nobody here has run it

Optimized Trivy Offline Scanning

This skill covers enhanced offline scanning techniques using Trivy.

Scanning All Dependencies

By default, Trivy might skip dev dependencies. For a complete audit of a package-lock.json, use the --include-dev-deps flag.

trivy fs /path/to/target \
  --format json \
  --output report.json \
  --scanners vuln \
  --include-dev-deps \
  --skip-db-update \
  --offline-scan \
  --cache-dir /path/to/trivy/cache

Troubleshooting Database Issues

If the scan fails due to database initialization, verify the path:

  1. Ensure trivy.db is in <cache-dir>/db/.
  2. Ensure the user has read permissions to the database file.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.