Trivy offline vulnerability scanning

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-claude-sonnet-4-6/dependency-vulnerability-check/trivy-offline-vulnerability-scanning

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill trivy-offline-vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use Trivy vulnerability scanner in offline/air-gapped mode to discover security vulnerabilities in dependency files (package-lock.json, requirements.txt, go.sum, etc.). Use this skill whenever the user asks to scan dependencies for vulnerabilities, perform a security audit, or find CVEs in a project — even without internet access. Covers setup, offline execution, and JSON report generation.

SKILL.md

2.9 KB, as published. Nobody here has run it

Trivy Offline Vulnerability Scanning

Trivy is a comprehensive vulnerability scanner. In offline mode it uses a pre-downloaded vulnerability database (trivy-cache/) instead of fetching from the internet.

Check Trivy availability and DB status

trivy --version
# Shows DB version and UpdatedAt timestamp — confirm DB exists before scanning

The DB is stored at ~/trivy-cache/ by default. It must be present for offline scanning.

Run an offline scan against a package-lock.json

trivy fs \
  --offline-scan \
  --cache-dir /root/trivy-cache \
  --skip-db-update \
  --skip-java-db-update \
  --format json \
  --output /root/trivy-results.json \
  /root/package-lock.json

Key flags:

--offline-scan — disables network lookups for vulnerability data
--skip-db-update / --skip-java-db-update — prevents DB download attempts
--cache-dir — points to the local DB directory
--format json — machine-readable output for post-processing
--severity HIGH,CRITICAL — filter to only high/critical if desired

Filter by severity at scan time

trivy fs \
  --offline-scan \
  --cache-dir /root/trivy-cache \
  --skip-db-update \
  --skip-java-db-update \
  --severity HIGH,CRITICAL \
  --format json \
  --output /root/trivy-results.json \
  /root/package-lock.json

JSON output structure

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Type": "npm",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-XXXXX",
          "PkgName": "lodash",
          "InstalledVersion": "4.17.20",
          "FixedVersion": "4.17.21",
          "Severity": "HIGH",
          "Title": "...",
          "Description": "...",
          "CVSS": { ... },
          "References": ["https://..."]
        }
      ]
    }
  ]
}

Parse results with Python

import json

with open("/root/trivy-results.json") as f:
    data = json.load(f)

for result in data.get("Results", []):
    for vuln in result.get("Vulnerabilities", []):
        print(vuln["VulnerabilityID"], vuln["PkgName"], vuln["Severity"])

Troubleshooting

Empty results: Confirm the DB UpdatedAt date is recent; old DBs may miss newer CVEs.
"unable to initialize DB": Check --cache-dir path is correct.
No Vulnerabilities key: The target file may have no known vulnerabilities, or the package ecosystem isn't supported. Check "Type" field in results.