Run3 Map Trivy JSON Fields to CSV Columns Accurately
[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.
npx -y skills add cxcscmu/SkillLearnBench --skill run3_Map-Trivy-JSON-Fields-to-CSV-Columns-AccuratelyAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Correctly identify and extract Trivy vulnerability JSON field names and map them to the required CSV output columns in exact order.
SKILL.md
1.3 KB, as published. Nobody here has run it
Field Mapping Reference
Map Trivy JSON fields to CSV columns in this exact order:
| CSV Column | Trivy JSON Field | Notes |
|---|---|---|
| Package | Target (from metadata) or parse from context | The package name identifier |
| Version | InstalledVersion | Not Version — use the exact field name |
| CVE_ID | VulnerabilityID | Not CVE_ID — use Trivy's field name |
| Severity | Severity | Case-sensitive: filter for HIGH and CRITICAL only |
| CVSS_Score | CVSS[source]['V3Score'] | Use priority: NVD → GHSA → RedHat |
| Fixed_Version | FixedVersion | Use "N/A" if null/missing, never empty string |
| Title | Title or Description | Vulnerability title/description text |
| Url | PrimaryURL or References[0] | Use PrimaryURL first, fallback to References[0], then "N/A" |
Process
- Inspect the actual Trivy JSON output to confirm exact field names
- Extract each field using correct path (e.g.,
vuln.get('VulnerabilityID')) - Verify field names are case-sensitive
- Apply fallbacks in specified order for URL and CVSS