[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KFQBVJXBGAT816SFB2B2PR":3,"skill-same:01M6KFQBVJXBGAT816SFB2B2PR":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":48,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M6KFQBVJXBGAT816SFB2B2PR","run2_trivy-offline-scanning",null,"Use Trivy vulnerability scanner in offline mode to scan dependency lock files and produce JSON vulnerability reports without internet access.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",93,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-claude-sonnet-4-6\u002Fdependency-vulnerability-check\u002Frun2_trivy-offline-scanning\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"offline","run2 trivy offline scanning","run2 trivy offline","trivy offline scanning","scanning","trivy","json","use","access","dependency","reports","files","scanner","scan","Trivy Vulnerability Scanner","internet","mode","lock","vulnerability","produce","2026-11-10 10:12:30",false,"---\nname: run2_trivy-offline-scanning\ndescription: Use Trivy vulnerability scanner in offline mode to scan dependency lock files and produce JSON vulnerability reports without internet access.\n---\n\n# Trivy Offline Vulnerability Scanning (Round 2)\n\n## Environment Details\n- Trivy binary: `\u002Fusr\u002Fbin\u002Ftrivy` (version 0.69.3)\n- Database cache: `\u002Froot\u002Ftrivy-cache\u002F` (contains `db\u002Ftrivy.db` and `db\u002Fmetadata.json`)\n- DB updated: 2026-01-21 (may be outdated — scan results reflect DB date)\n\n## Key Command\n\n```bash\ntrivy fs \u002Froot\u002Fpackage-lock.json \\\n  --format json \\\n  --output \u002Froot\u002Ftrivy_report.json \\\n  --scanners vuln \\\n  --skip-db-update \\\n  --offline-scan \\\n  --cache-dir \u002Froot\u002Ftrivy-cache\n```\n\n## Important Flags\n| Flag | Purpose |\n|------|---------|\n| `fs \u003Cfile>` | Scan a dependency lock file directly |\n| `--skip-db-update` | Don't fetch updated DB (offline requirement) |\n| `--offline-scan` | Disable all network calls |\n| `--cache-dir` | Point to offline DB location |\n| `--scanners vuln` | Only vulnerability scanning (skip misconfig) |\n\n## Behavior Notes\n- Trivy by default **suppresses dev dependencies** — use `--include-dev-deps` if needed\n- Output goes to the file specified by `--output`; stdout shows only progress logs\n- Non-zero exit code indicates scan failure (not just vulnerability presence)\n\n## Python Wrapper\n\n```python\nimport subprocess, sys, os\n\ndef run_trivy_scan(target='\u002Froot\u002Fpackage-lock.json',\n                   output='\u002Froot\u002Ftrivy_report.json',\n                   cache_dir='\u002Froot\u002Ftrivy-cache'):\n    db_path = os.path.join(cache_dir, 'db', 'trivy.db')\n    if not os.path.exists(db_path):\n        print(f\"[!] DB not found at {db_path}\")\n        sys.exit(1)\n\n    cmd = [\n        'trivy', 'fs', target,\n        '--format', 'json',\n        '--output', output,\n        '--scanners', 'vuln',\n        '--skip-db-update',\n        '--offline-scan',\n        '--cache-dir', cache_dir\n    ]\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    if result.returncode != 0:\n        print(result.stderr)\n        sys.exit(1)\n    print(f\"[+] Scan complete: {output}\")\n    return output\n```\n\n## JSON Output Structure\n\n```json\n{\n  \"Results\": [\n    {\n      \"Target\": \"package-lock.json\",\n      \"Class\": \"lang-pkgs\",\n      \"Type\": \"npm\",\n      \"Vulnerabilities\": [\n        {\n          \"VulnerabilityID\": \"CVE-2024-29415\",\n          \"PkgName\": \"ip\",\n          \"InstalledVersion\": \"2.0.0\",\n          \"FixedVersion\": \"\",        \u002F\u002F Empty string = no fix; use 'N\u002FA'\n          \"Severity\": \"HIGH\",\n          \"Title\": \"node-ip: Incomplete fix for CVE-2023-42282\",\n          \"PrimaryURL\": \"https:\u002F\u002Favd.aquasec.com\u002Fnvd\u002Fcve-2024-29415\",\n          \"CVSS\": {\n            \"ghsa\": { \"V3Score\": 8.1 },\n            \"redhat\": { \"V3Score\": 9.8 }\n          }\n        }\n      ]\n    }\n  ]\n}\n```\n\n## Gotchas\n- `FixedVersion` can be `None` OR an empty string `\"\"` — handle both as 'N\u002FA'\n- `Vulnerabilities` key may be `null` (not just missing) — use `or []` not just `.get()`\n- Multiple fix versions are comma-separated in a single string: `\"7.5.2, 6.3.1, 5.7.2\"`\n","# Trivy Offline Vulnerability Scanning (Round 2)\n\n## Environment Details\n- Trivy binary: `\u002Fusr\u002Fbin\u002Ftrivy` (version 0.69.3)\n- Database cache: `\u002Froot\u002Ftrivy-cache\u002F` (contains `db\u002Ftrivy.db` and `db\u002Fmetadata.json`)\n- DB updated: 2026-01-21 (may be outdated — scan results reflect DB date)\n\n## Key Command\n\n```bash\ntrivy fs \u002Froot\u002Fpackage-lock.json \\\n  --format json \\\n  --output \u002Froot\u002Ftrivy_report.json \\\n  --scanners vuln \\\n  --skip-db-update \\\n  --offline-scan \\\n  --cache-dir \u002Froot\u002Ftrivy-cache\n```\n\n## Important Flags\n| Flag | Purpose |\n|------|---------|\n| `fs \u003Cfile>` | Scan a dependency lock file directly |\n| `--skip-db-update` | Don't fetch updated DB (offline requirement) |\n| `--offline-scan` | Disable all network calls |\n| `--cache-dir` | Point to offline DB location |\n| `--scanners vuln` | Only vulnerability scanning (skip misconfig) |\n\n## Behavior Notes\n- Trivy by default **suppresses dev dependencies** — use `--include-dev-deps` if needed\n- Output goes to the file specified by `--output`; stdout shows only progress logs\n- Non-zero exit code indicates scan failure (not just vulnerability presence)\n\n## Python Wrapper\n\n```python\nimport subprocess, sys, os\n\ndef run_trivy_scan(target='\u002Froot\u002Fpackage-lock.json',\n                   output='\u002Froot\u002Ftrivy_report.json',\n                   cache_dir='\u002Froot\u002Ftrivy-cache'):\n    db_path = os.path.join(cache_dir, 'db', 'trivy.db')\n    if not os.path.exists(db_path):\n        print(f\"[!] DB not found at {db_path}\")\n        sys.exit(1)\n\n    cmd = [\n        'trivy', 'fs', target,\n        '--format', 'json',\n        '--output', output,\n        '--scanners', 'vuln',\n        '--skip-db-update',\n        '--offline-scan',\n        '--cache-dir', cache_dir\n    ]\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    if result.returncode != 0:\n        print(result.stderr)\n        sys.exit(1)\n    print(f\"[+] Scan complete: {output}\")\n    return output\n```\n\n## JSON Output Structure\n\n```json\n{\n  \"Results\": [\n    {\n      \"Target\": \"package-lock.json\",\n      \"Class\": \"lang-pkgs\",\n      \"Type\": \"npm\",\n      \"Vulnerabilities\": [\n        {\n          \"VulnerabilityID\": \"CVE-2024-29415\",\n          \"PkgName\": \"ip\",\n          \"InstalledVersion\": \"2.0.0\",\n          \"FixedVersion\": \"\",        \u002F\u002F Empty string = no fix; use 'N\u002FA'\n          \"Severity\": \"HIGH\",\n          \"Title\": \"node-ip: Incomplete fix for CVE-2023-42282\",\n          \"PrimaryURL\": \"https:\u002F\u002Favd.aquasec.com\u002Fnvd\u002Fcve-2024-29415\",\n          \"CVSS\": {\n            \"ghsa\": { \"V3Score\": 8.1 },\n            \"redhat\": { \"V3Score\": 9.8 }\n          }\n        }\n      ]\n    }\n  ]\n}\n```\n\n## Gotchas\n- `FixedVersion` can be `None` OR an empty string `\"\"` — handle both as 'N\u002FA'\n- `Vulnerabilities` key may be `null` (not just missing) — use `or []` not just `.get()`\n- Multiple fix versions are comma-separated in a single string: `\"7.5.2, 6.3.1, 5.7.2\"`\n",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb2-self-feedback-claude-sonnet-4-6\u002Fdependency-vulnerability-check\u002Frun2_trivy-offline-scanning",8,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill run2_trivy-offline-scanning",{"tool":57,"command":58},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill run2_trivy-offline-scanning",{"tool":60,"command":61},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill run2_trivy-offline-scanning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-claude-sonnet-4-6\u002Fdependency-vulnerability-check\u002Frun2_trivy-offline-scanning\u002FSKILL.md",true,[],[66,84,109,127,146,158],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":77,"publishedAt":38},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[72],{"categoryNo":73,"categoryName":74,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[78,79,80,81,82,83],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":93,"publishedAt":38},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[90],{"categoryNo":91,"categoryName":92,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000023","Skill与智能体开发",[94,95,96,97,98,99,100,101,102,103,104,105,106,107,108],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","for","user","it","requirements","essential","itineraries",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":38},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[116,117,118,119,120,121,122,97,123,124,98,125,103,126,95],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":38},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[134,135,136,103,137,138,24,139,140,141,142,143,125,144,145],"glm output","output","glm","tasks","metrics","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":38},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[152],{"categoryNo":91,"categoryName":92,"taxonomyType":75,"taxonomyTypeDesc":76},[154,145,136,135,140,139,137,155,156,103,157],"glm calibration","setup","companion","metric",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":38},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[165,136,139,166,154,145,103,135,167,29,168,25,169,170,137],"glm basics","inspect","relevant","good","how","Evaluation"]