trivy-offline-vulnerability-scanning

What problem does it solve?

This skill enables vulnerability assessment of software dependencies in air-gapped environments by scanning dependency lock files using Trivy with a pre-downloaded database to produce offline results.

Core Features & Use Cases

• Offline database usage: use a pre-downloaded Trivy database for scans without internet access.
• Dependency file scanning: target files like package-lock.json, yarn.lock, or go.sum to detect known CVEs.
• JSON reporting: generate structured JSON outputs for integration with audits and CI pipelines.
• Use Case: perform a security review of a project in a restricted network without external connectivity.

Quick Start

Place the offline Trivy database in your cache directory, then run a filesystem scan on your dependency lock file to generate a JSON report.