trivy-offline-vulnerability-scanning

name	trivy-offline-vulnerability-scanning
description	Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.

Trivy Offline Vulnerability Scanning

Scan dependency files for known vulnerabilities using Trivy's offline mode, which avoids network calls by using a pre-downloaded vulnerability database.

Workflow

1. Run Trivy in Offline Mode

Key flags for offline filesystem scanning:

Flag	Purpose
fs <target>	Scan a dependency file (e.g., package-lock.json)
--format json	Output structured JSON for parsing
--output <file>	Save results to a file
--scanners vuln	Only scan for vulnerabilities (skip misconfigs)
--skip-db-update	Do not attempt to update the vulnerability DB
--offline-scan	Enable fully offline mode
--severity HIGH,CRITICAL	Filter by severity at scan time

2. Example Command

trivy fs /root/package-lock.json \
  --format json \
  --output /root/trivy_report.json \
  --scanners vuln \
  --skip-db-update \
  --offline-scan \
  --severity HIGH,CRITICAL

3. JSON Output Structure

Trivy outputs vulnerability data in this structure:

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-44906",
          "PkgName": "minimist",
          "InstalledVersion": "1.2.5",
          "FixedVersion": "1.2.6",
          "Severity": "CRITICAL",
          "Title": "Prototype Pollution in minimist",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44906",
          "CVSS": {
            "nvd": { "V3Score": 9.8 },
            "ghsa": { "V3Score": 9.8 }
          }
        }
      ]
    }
  ]
}

Troubleshooting

• "failed to initialize DB": Database not found — check --cache-dir path or re-download
• No results when vulns expected: Database may be outdated — update before going offline
• "command not found: trivy": Trivy not installed or not in PATH