Run1 grype trivy offline vulnerability scanning

Skill cxcscmu/SkillLearnBench/skills/b3-teacher-feedback-claude-opus-4-6/dependency-vulnerability-check/run1_grype-trivy-offline-vulnerability-scanning

How to use offline vulnerability scanning tools like grype, trivy, or osv-scanner to detect vulnerabilities in dependency lock files without network access.From its SKILL.md

Install

npx -y skills add cxcscmu/SkillLearnBench --skill run1_grype-trivy-offline-vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.8 KB, 486 tokens by cl100k_base, as published. Nobody here has run it

Grype (Anchore)

Grype scans container images and filesystem paths for vulnerabilities using a local database.

# Scan a lockfile directory
grype dir:/root/ --only-fixed --output json

# Scan specifically for npm
grype sbom:package-lock.json

# Filter by severity
grype dir:/root/ --fail-on high

Grype JSON Output

{
  "matches": [
    {
      "vulnerability": {
        "id": "CVE-2021-XXXXX",
        "severity": "High",
        "cvss": [{"metrics": {"baseScore": 7.5}}],
        "fix": {"versions": ["1.2.3"], "state": "fixed"},
        "urls": ["https://nvd.nist.gov/vuln/detail/CVE-2021-XXXXX"]
      },
      "artifact": {
        "name": "package-name",
        "version": "1.0.0"
      }
    }
  ]
}

Trivy

# Scan filesystem
trivy fs /root/ --severity HIGH,CRITICAL --format json

# Scan specific lockfile
trivy fs --scanners vuln --severity HIGH,CRITICAL /root/package-lock.json

Trivy JSON Output

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-XXXXX",
          "PkgName": "package-name",
          "InstalledVersion": "1.0.0",
          "FixedVersion": "1.2.3",
          "Severity": "HIGH",
          "Title": "Description",
          "CVSS": {"nvd": {"V3Score": 7.5}},
          "PrimaryURL": "https://..."
        }
      ]
    }
  ]
}

osv-scanner

osv-scanner --lockfile=/root/package-lock.json --format json

Updating Offline Databases

# Grype
grype db update
grype db status

# Trivy
trivy --download-db-only
# DB location: ~/.cache/trivy/db/

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.