メニュー
Use Trivy vulnerability scanner in offline mode to detect CVEs in npm dependencies and generate structured JSON reports.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | trivy-vulnerability-scanning |
| description | Use Trivy vulnerability scanner in offline mode to detect CVEs in npm dependencies and generate structured JSON reports. |
Trivy is a simple, comprehensive vulnerability scanner that can analyze npm package-lock.json files for known security vulnerabilities. It works offline with a local vulnerability database.
# Install Trivy
apt-get update && apt-get install -y trivy
# Verify installation
trivy --version
Trivy requires a vulnerability database. For offline mode:
# Download the vulnerability database
trivy image download-db --severity HIGH,CRITICAL
# Or let Trivy auto-download on first use
trivy config /root/package-lock.json
trivy config /root/package-lock.json \
--format json \
--output results.json \
--severity HIGH,CRITICAL
--format json: Output JSON format (best for parsing)--severity HIGH,CRITICAL: Only HIGH and CRITICAL vulnerabilities--output file.json: Write to file--offline-db: Use offline database if downloaded--skip-update: Skip database update (offline mode)Trivy JSON output contains:
{
"Results": [
{
"Target": "package-lock.json",
"Type": "npm",
"Misconfigurations": null,
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2021-12345",
"PkgName": "lodash",
"InstalledVersion": "4.17.20",
"FixedVersion": "4.17.21",
"Severity": "HIGH",
"Title": "Prototype pollution",
"Description": "...",
"References": ["https://nvd.nist.gov/vuln/detail/CVE-2021-12345"]
}
]
}
]
}
import json
def parse_trivy_results(json_file):
with open(json_file, 'r') as f:
data = json.load(f)
vulnerabilities = []
for result in data.get('Results', []):
for vuln in result.get('Vulnerabilities', []):
if vuln['Severity'] in ['HIGH', 'CRITICAL']:
vulnerabilities.append({
'package': vuln['PkgName'],
'version': vuln['InstalledVersion'],
'cve_id': vuln['VulnerabilityID'],
'severity': vuln['Severity'],
'title': vuln['Title'],
'fixed_version': vuln.get('FixedVersion', 'N/A'),
'references': vuln.get('References', [])
})
return vulnerabilities
Use this skill when:
cvss-score-extraction: Extract CVSS scores for detected vulnerabilitiessecurity-audit-csv-reporting: Convert results to CSV formatHandles reading, populating, and saving .docx files using the python-docx library. Use this skill for any tasks involving template filling or modifying Word documents.
Perform various data analysis on SEC 13-F and obtain some insights of fund activities such as number of holdings, AUM, and change of holdings between two quarters.
This skill includes search capability in 13F, such as fuzzy search a fund information using possibly inaccurate name, or fuzzy search a stock cusip info using its name.
A comprehensive PDF toolkit for advanced data extraction and document analysis. Beyond text and table extraction, this tool is optimized for visual layout reasoning: it can map graphical elements to coordinates (such as determining appointment times based on their position on a calendar timeline) and identify color-coded features (e.g., distinguishing high-priority blocks from flexible blue-colored entries). Use this skill when the task requires interpreting schedule layouts, calculating durations from visual spans, or resolving scheduling conflicts based on the spatial and color properties of a PDF document.
Build deterministic, verifiable data visualizations with D3.js (v6). Generate standalone HTML/SVG (and optional PNG) from local data files without external network dependencies. Use when tasks require charts, plots, axes/scales, legends, tooltips, or data-driven SVG output.
invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.