trivy-offline-vulnerability-scanning

name	trivy-offline-vulnerability-scanning
description	Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.

Trivy Offline Vulnerability Scanning

This skill provides guidance on using Trivy, an open-source security scanner, to discover vulnerabilities in software dependencies using offline mode.

Overview

Trivy is a comprehensive vulnerability scanner that can analyze various targets including container images, filesystems, and dependency lock files. Offline scanning is crucial for environments without internet access or for reproducible security audits.

Offline Scanning Workflow

Step 1: Verify Database Existence

Before scanning, ensure the offline database is available. In this environment, it is usually located in .cache/trivy/db/.

Step 2: Construct Trivy Command

Key flags for offline scanning:

Flag	Purpose
fs <target>	Scan filesystem/file (e.g., package-lock.json)
--format json	Output in JSON format for parsing
--output <file>	Save results to file
--scanners vuln	Scan only for vulnerabilities
--skip-db-update	Do not update database
--offline-scan	Enable offline mode
--cache-dir <path>	Path to pre-downloaded database

Example Command

trivy fs package-lock.json \
  --format json \
  --output trivy_report.json \
  --scanners vuln \
  --skip-db-update \
  --offline-scan \
  --cache-dir .cache/trivy

JSON Output Structure

Trivy outputs vulnerability data in this format:

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-44906",
          "PkgName": "minimist",
          "InstalledVersion": "1.2.5",
          "FixedVersion": "1.2.6",
          "Severity": "CRITICAL",
          "Title": "Prototype Pollution in minimist",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44906",
          "CVSS": {
            "nvd": { "V3Score": 9.8 }
          }
        }
      ]
    }