Trivy offline vulnerability scanning

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-gemini-3-flash-preview/dependency-vulnerability-check/trivy-offline-vulnerability-scanning

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill trivy-offline-vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.

SKILL.md

2.2 KB, as published. Nobody here has run it

Trivy Offline Vulnerability Scanning

This skill provides guidance on using Trivy, an open-source security scanner, to discover vulnerabilities in software dependencies using offline mode.

Overview

Trivy is a comprehensive vulnerability scanner that can analyze various targets including container images, filesystems, and dependency lock files. Offline scanning is crucial for environments without internet access or for reproducible security audits.

Offline Scanning Workflow

Step 1: Verify Database Existence

Before scanning, ensure the offline database is available. In this environment, it is usually located in .cache/trivy/db/.

Step 2: Construct Trivy Command

Key flags for offline scanning:

Flag	Purpose
`fs <target>`	Scan filesystem/file (e.g., package-lock.json)
`--format json`	Output in JSON format for parsing
`--output <file>`	Save results to file
`--scanners vuln`	Scan only for vulnerabilities
`--skip-db-update`	Do not update database
`--offline-scan`	Enable offline mode
`--cache-dir <path>`	Path to pre-downloaded database

Example Command

trivy fs package-lock.json \
  --format json \
  --output trivy_report.json \
  --scanners vuln \
  --skip-db-update \
  --offline-scan \
  --cache-dir .cache/trivy

JSON Output Structure

Trivy outputs vulnerability data in this format:

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-44906",
          "PkgName": "minimist",
          "InstalledVersion": "1.2.5",
          "FixedVersion": "1.2.6",
          "Severity": "CRITICAL",
          "Title": "Prototype Pollution in minimist",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44906",
          "CVSS": {
            "nvd": { "V3Score": 9.8 }
          }
        }
      ]
    }
  ]
}