Npm vulnerability scanning

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-claude-haiku-4-5/dependency-vulnerability-check/npm-vulnerability-scanning

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill npm-vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Scan npm package-lock.json files for vulnerabilities using Trivy in offline mode. Extracts HIGH and CRITICAL severity vulnerabilities with detailed metadata (CVE, CVSS, fix versions). Use this skill whenever you need to audit npm dependencies for security issues, especially when an offline vulnerability database is available.

SKILL.md

3.6 KB, as published. Nobody here has run it

NPM Vulnerability Scanning with Trivy

Overview

This skill enables security scanning of npm package-lock.json files using Trivy's offline mode. It focuses on extracting HIGH and CRITICAL severity vulnerabilities with complete metadata.

Prerequisites

Trivy installed and available in PATH
Trivy database cached locally (or downloadable)
npm package-lock.json file to scan
jq or Python for JSON parsing

Workflow

1. Verify Trivy Installation and Database

trivy version
trivy db info

Check that the vulnerability database is available. If not cached, Trivy can download it during the first scan.

2. Scan package-lock.json

Run Trivy with JSON output for programmatic processing:

trivy config /root/package-lock.json \
  --format json \
  --severity HIGH,CRITICAL \
  --output /tmp/trivy_results.json

Key flags:

--format json: Machine-readable output
--severity HIGH,CRITICAL: Filter to target severity levels only
--scanners vuln: Focus on vulnerability scanning
--offline-db: Use offline database (if available)

3. Parse and Extract Vulnerability Data

The JSON output contains nested results. Extract this structure:

Results[].Vulnerabilities[] → {
  VulnerabilityID (CVE ID),
  Severity,
  Title,
  Description,
  CVSS scores (multiple sources),
  FixedVersion,
  PkgName,
  InstalledVersion,
  References[] (URLs)
}

4. Handling Multiple CVSS Score Sources

Trivy reports CVSS scores from multiple sources (NVD, GHSA, RedHat). Extract in priority order:

NVD (National Vulnerability Database) - most common
GHSA (GitHub Security Advisory)
RedHat

Store the first available score with its source metadata.

5. Expected Output Fields

For each vulnerability, collect:

Package: Package name from PkgName
Version: InstalledVersion
CVE_ID: VulnerabilityID (format: CVE-YYYY-XXXXX)
Severity: HIGH or CRITICAL
CVSS_Score: Primary CVSS v3 score (numeric, e.g., 7.5)
Fixed_Version: FixedVersion field (or "N/A" if not available)
Title: Vulnerability title/description
Url: First valid reference URL from References array

6. Edge Cases

No fixed version: Set to "N/A"
Missing CVSS score: Record as "N/A" (rare for HIGH/CRITICAL)
Multiple package types: Trivy treats npm as npm, yarn as npm
Duplicate CVEs: May appear if reported by multiple sources — deduplicate by CVE ID

Offline Mode Considerations

If running in strict offline mode:

trivy config /root/package-lock.json \
  --offline-db \
  --format json \
  --severity HIGH,CRITICAL

Ensure the database file exists at $HOME/.cache/trivy/db/trivy.db before running offline scans.

Common Issues

Issue	Solution
Database not found	Run `trivy db download` or allow online access for first scan
No results returned	Verify package-lock.json path and format are valid
CVSS missing	May indicate vulnerability data is incomplete — use what's available
Permission denied	Ensure read access to package-lock.json and /tmp directory

Next Steps

After scanning, pass the JSON results to the vulnerability-data-processing skill for formatting and CSV export.