trivy-offline-vulnerability-scanning

name	trivy-offline-vulnerability-scanning
description	Use Trivy vulnerability scanner in offline/air-gapped mode to discover security vulnerabilities in dependency files (package-lock.json, requirements.txt, go.sum, etc.). Use this skill whenever the user asks to scan dependencies for vulnerabilities, perform a security audit, or find CVEs in a project — even without internet access. Covers setup, offline execution, and JSON report generation.

Trivy Offline Vulnerability Scanning

Trivy is a comprehensive vulnerability scanner. In offline mode it uses a pre-downloaded vulnerability database (trivy-cache/) instead of fetching from the internet.

Check Trivy availability and DB status

trivy --version
# Shows DB version and UpdatedAt timestamp — confirm DB exists before scanning

The DB is stored at ~/trivy-cache/ by default. It must be present for offline scanning.

Run an offline scan against a package-lock.json

trivy fs \
  --offline-scan \
  --cache-dir /root/trivy-cache \
  --skip-db-update \
  --skip-java-db-update \
  --format json \
  --output /root/trivy-results.json \
  /root/package-lock.json

Key flags:

• --offline-scan — disables network lookups for vulnerability data
• --skip-db-update / --skip-java-db-update — prevents DB download attempts
• --cache-dir — points to the local DB directory
• --format json — machine-readable output for post-processing
• --severity HIGH,CRITICAL — filter to only high/critical if desired

Filter by severity at scan time

trivy fs \
  --offline-scan \
  --cache-dir /root/trivy-cache \
  --skip-db-update \
  --skip-java-db-update \
  --severity HIGH,CRITICAL \
  --format json \
  --output /root/trivy-results.json \
  /root/package-lock.json

JSON output structure

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Type": "npm",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-XXXXX",
          "PkgName": "lodash",
          "InstalledVersion": "4.17.20",
          "FixedVersion": "4.17.21",
          "Severity": "HIGH",
          "Title": "...",
          "Description": "...",
          "CVSS": { ... },
          "References": ["https://..."]
        }
      
    
  

Parse results with Python

import json

with open("/root/trivy-results.json") as f:
    data = json.load(f)

for result in data.get("Results", []):
    for vuln in result.get("Vulnerabilities", []):
        print(vuln["VulnerabilityID"], vuln["PkgName"], vuln["Severity"])

Troubleshooting

• Empty results: Confirm the DB UpdatedAt date is recent; old DBs may miss newer CVEs.
• "unable to initialize DB": Check --cache-dir path is correct.
• No Vulnerabilities key: The target file may have no known vulnerabilities, or the package ecosystem isn't supported. Check "Type" field in results.