trivy-offline-scanning
Use Trivy for offline vulnerability scanning of dependency files like package-lock.json.
- License 许可
- MIT
- 最近更新
- 2026-10-02
- Stars
- ★ 93
- Forks
- 8
01 前言 Front Matter
- name
- trivy-offline-scanning
- description
- Use Trivy for offline vulnerability scanning of dependency files like package-lock.json.
03 SKILL.md 正文
Trivy Offline Vulnerability Scanning
Trivy can be used to scan dependency files (e.g. package-lock.json) offline without updating its database or querying the network for dependency analysis.
Prerequisites
- Trivy installed.
- Vulnerability DB present in the Trivy cache directory.
Usage
To scan a file like package-lock.json and output the results as a JSON file, use the following command:
trivy fs --skip-db-update --offline-scan --format json --output trivy-report.json <path-to-file>
Options Explained:
fs: Scan a filesystem path or a specific file.--skip-db-update: Prevents Trivy from attempting to update the vulnerability database, crucial for offline scanning.--offline-scan: Prevents Trivy from issuing API requests to identify dependencies.--format json: Formats the output as JSON for easier programmatic parsing.--output trivy-report.json: Saves the output to the specified file.
This approach ensures zero network calls during the analysis of dependency manifests.
04 同仓库更多 Skills
object_counter
Count occurrences of an object in the image using computer vision algorithm.
travel-planning-workflow
Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.
bundled-dataset-search-tool
invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.
glm-output
Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final /root/metrics.json.
glm-calibration
Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.
glm-basics
A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.