Trivy Offline Vulnerability Scanning
SkillFiles & storageUse Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Trivy Offline Vulnerability Scanning skill
What this skill tells your AI
The instructions your AI receives, as published by cxcscmu/skilllearnbench in skills/human_authored/dependency-vulnerability-check/trivy-offline-vulnerability-scanning/SKILL.md and read by ahel’s review.
Overview
Trivy is a comprehensive security scanner that can detect vulnerabilities in OS packages and application dependencies. In offline mode, it uses a pre-downloaded vulnerability database.
Key Commands
Scan a package-lock.json file (offline, JSON output)
trivy fs --skip-db-update --skip-java-db-update \
--format json \
--scanners vuln \
--pkg-types library \
--severity HIGH,CRITICAL \
/path/to/package-lock.json
Important Flags
--skip-db-update: Use the already-downloaded DB (offline mode)--skip-java-db-update: Skip Java DB update for non-Java projects--format json: Machine-readable output for downstream processing--severity HIGH,CRITICAL: Filter by severity level--scanners vuln: Only scan for vulnerabilities (skip misconfig, secret, etc.)--pkg-types library: Scan application libraries only
Output Structure (JSON)
The JSON output contains a Results array. Each result has:
Target: the scanned fileVulnerabilities: array of vulnerability objects with fields:PkgName: package nameInstalledVersion: installed versionVulnerabilityID: CVE ID (e.g., CVE-2023-1234)Severity: HIGH, CRITICAL, etc.CVSS: object with scoring from multiple sources (nvd, ghsa, redhat)FixedVersion: version that fixes the vulnerability (may be empty)Title: short vulnerability titlePrimaryURL: reference URLDescription: longer description (use if Title is empty)
Signals
- GitHub stars
- 83
- Forks
- 5
- Last commit
- Jul 2026
Advanced
- Catalog kind
- skill
- Gateway key
trivy-offline-vulnerability-scanning- Source
- github.com/cxcscmu/skilllearnbench