Dependency Vulnerability Scanner

Supply chain attacks often hide in plain sight within your deep dependency tree. This skill automates software composition analysis (SCA) to identify known vulnerabilities across multiple ecosystems before they reach production.

What it does

• Multi-manifest parsing identifies dependencies in Python, JavaScript, Go, Rust, Ruby, PHP, Java, and .NET lockfiles.
• Vulnerability matching queries the OSV.dev database to find active CVEs and GHSAs affecting your specific versions.
• SBOM generation produces a complete inventory of project packages in JSON or CSV formats.
• CI enforcement provides exit codes to block builds containing high-severity vulnerabilities.
• Remediation guidance highlights fixed versions and distinguishes between direct and transitive risks.

How it works

1. Targeting involves pointing the scanner at a project root or specific manifest files like package-lock.json or poetry.lock.
2. Analysis parses the local files to build a dependency graph and identify pinned versions.
3. Lookup sends batches of package identifiers to the OSV API for real-time vulnerability status.
4. Reporting outputs a prioritized list of risks or a full inventory based on the selected flags.

Frameworks & tools

This tool uses Python to interface with the OSV.dev API. It supports npm, yarn, pnpm, pip, poetry, pipenv, cargo, composer, maven, and nuget lockfile formats.

Why this beats prompting it yourself

Manual audits miss nested transitive dependencies and quickly become outdated as new CVEs are published. This skill performs precise version-matching against the OSV database, providing machine-readable outputs that a standard LLM cannot generate through reasoning alone.

Use cases

• Audit a legacy repository for high-severity vulnerabilities and technical debt.
• Verify if a specific reported CVE affects any packages in your current stack.
• Generate a CSV-based SBOM for compliance or security documentation.
• Add an automated security gate to a GitHub Actions or GitLab CI pipeline.

Known limitations

Unpinned requirements, such as those using version ranges in a requirements.txt file, cannot be checked for precise vulnerabilities. Analysis of reachability for specific functions is not automated.