Trivy offline vulnerability scanning

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-claude-opus-4-6/dependency-vulnerability-check/trivy-offline-vulnerability-scanning

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill trivy-offline-vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.

SKILL.md

2.2 KB, as published. Nobody here has run it

Trivy Offline Vulnerability Scanning

Scan dependency files for known vulnerabilities using Trivy's offline mode, which avoids network calls by using a pre-downloaded vulnerability database.

Workflow

1. Run Trivy in Offline Mode

Key flags for offline filesystem scanning:

Flag	Purpose
`fs <target>`	Scan a dependency file (e.g., package-lock.json)
`--format json`	Output structured JSON for parsing
`--output <file>`	Save results to a file
`--scanners vuln`	Only scan for vulnerabilities (skip misconfigs)
`--skip-db-update`	Do not attempt to update the vulnerability DB
`--offline-scan`	Enable fully offline mode
`--severity HIGH,CRITICAL`	Filter by severity at scan time

2. Example Command

trivy fs /root/package-lock.json \
  --format json \
  --output /root/trivy_report.json \
  --scanners vuln \
  --skip-db-update \
  --offline-scan \
  --severity HIGH,CRITICAL

3. JSON Output Structure

Trivy outputs vulnerability data in this structure:

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-44906",
          "PkgName": "minimist",
          "InstalledVersion": "1.2.5",
          "FixedVersion": "1.2.6",
          "Severity": "CRITICAL",
          "Title": "Prototype Pollution in minimist",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44906",
          "CVSS": {
            "nvd": { "V3Score": 9.8 },
            "ghsa": { "V3Score": 9.8 }
          }
        }
      ]
    }
  ]
}

Troubleshooting

"failed to initialize DB": Database not found — check --cache-dir path or re-download
No results when vulns expected: Database may be outdated — update before going offline
"command not found: trivy": Trivy not installed or not in PATH