Imported from cxcscmu/SkillLearnBench (
skills/b1-one-shot-gemini-3-flash-preview/dependency-vulnerability-check/trivy-offline-vulnerability-scanning/SKILL.md). Install upstream withnpx skills add cxcscmu/SkillLearnBench --skill trivy-offline-vulnerability-scanning. Copyright stays with the author.
Trivy Offline Vulnerability Scanning
Trivy can be used to scan package manager lock files (like package-lock.json, yarn.lock, Cargo.lock) in offline mode by utilizing a pre-downloaded vulnerability database.
Prerequisites
- Trivy binary installed and available in the PATH.
- A local Trivy database (typically located in
~/.cache/trivy/db).
Usage Pattern
To perform an offline scan of a filesystem path and output the results in JSON format:
trivy fs --offline-scan --format json --output report.json <path_to_file_or_dir>Filtering by Severity
While you can filter in the command line using --severity, it's often better to get the full report and filter during processing to ensure no data is lost for further analysis.
trivy fs --offline-scan --severity HIGH,CRITICAL --format json <path>JSON Report Structure
The JSON output contains a Results array. Each element in Results corresponds to a target (e.g., a file) and contains a Vulnerabilities array.
Each vulnerability object typically includes:
VulnerabilityID(e.g., CVE-2023-1234)PkgNameInstalledVersionFixedVersionPrimaryURLTitleDescriptionSeverityCVSS(a map of sources to CVSS scores)