Trivy Offline Vulnerability Scanning

SkillFiles & storage

Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.

Available today. Use it from your connected AI after setup.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the Trivy Offline Vulnerability Scanning skill

What this skill tells your AI

The instructions your AI receives, as published by cxcscmu/skilllearnbench in skills/human_authored/dependency-vulnerability-check/trivy-offline-vulnerability-scanning/SKILL.md and read by ahel’s review.

Overview

Trivy is a comprehensive security scanner that can detect vulnerabilities in OS packages and application dependencies. In offline mode, it uses a pre-downloaded vulnerability database.

Key Commands

Scan a package-lock.json file (offline, JSON output)

trivy fs --skip-db-update --skip-java-db-update \
  --format json \
  --scanners vuln \
  --pkg-types library \
  --severity HIGH,CRITICAL \
  /path/to/package-lock.json

Important Flags

  • --skip-db-update: Use the already-downloaded DB (offline mode)
  • --skip-java-db-update: Skip Java DB update for non-Java projects
  • --format json: Machine-readable output for downstream processing
  • --severity HIGH,CRITICAL: Filter by severity level
  • --scanners vuln: Only scan for vulnerabilities (skip misconfig, secret, etc.)
  • --pkg-types library: Scan application libraries only

Output Structure (JSON)

The JSON output contains a Results array. Each result has:

  • Target: the scanned file
  • Vulnerabilities: array of vulnerability objects with fields:
    • PkgName: package name
    • InstalledVersion: installed version
    • VulnerabilityID: CVE ID (e.g., CVE-2023-1234)
    • Severity: HIGH, CRITICAL, etc.
    • CVSS: object with scoring from multiple sources (nvd, ghsa, redhat)
    • FixedVersion: version that fixes the vulnerability (may be empty)
    • Title: short vulnerability title
    • PrimaryURL: reference URL
    • Description: longer description (use if Title is empty)

Signals

GitHub stars
83
Forks
5
Last commit
Jul 2026
Advanced
Catalog kind
skill
Gateway key
trivy-offline-vulnerability-scanning
Source
github.com/cxcscmu/skilllearnbench