Run1 grype trivy offline vulnerability scanning

Skill cxcscmu/SkillLearnBench/skills/b3-teacher-feedback-claude-opus-4-6/dependency-vulnerability-check/run1_grype-trivy-offline-vulnerability-scanning

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill run1_grype-trivy-offline-vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

How to use offline vulnerability scanning tools like grype, trivy, or osv-scanner to detect vulnerabilities in dependency lock files without network access.

SKILL.md

1.8 KB, as published. Nobody here has run it

Grype (Anchore)

Grype scans container images and filesystem paths for vulnerabilities using a local database.

# Scan a lockfile directory
grype dir:/root/ --only-fixed --output json

# Scan specifically for npm
grype sbom:package-lock.json

# Filter by severity
grype dir:/root/ --fail-on high

Grype JSON Output

{
  "matches": [
    {
      "vulnerability": {
        "id": "CVE-2021-XXXXX",
        "severity": "High",
        "cvss": [{"metrics": {"baseScore": 7.5}}],
        "fix": {"versions": ["1.2.3"], "state": "fixed"},
        "urls": ["https://nvd.nist.gov/vuln/detail/CVE-2021-XXXXX"]
      },
      "artifact": {
        "name": "package-name",
        "version": "1.0.0"
      }
    }
  ]
}

Trivy

# Scan filesystem
trivy fs /root/ --severity HIGH,CRITICAL --format json

# Scan specific lockfile
trivy fs --scanners vuln --severity HIGH,CRITICAL /root/package-lock.json

Trivy JSON Output

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-XXXXX",
          "PkgName": "package-name",
          "InstalledVersion": "1.0.0",
          "FixedVersion": "1.2.3",
          "Severity": "HIGH",
          "Title": "Description",
          "CVSS": {"nvd": {"V3Score": 7.5}},
          "PrimaryURL": "https://..."
        }
      ]
    }
  ]
}

osv-scanner

osv-scanner --lockfile=/root/package-lock.json --format json

Updating Offline Databases

# Grype
grype db update
grype db status

# Trivy
trivy --download-db-only
# DB location: ~/.cache/trivy/db/