dependency-vulnerability-audit
Installation
SKILL.md
Dependency Vulnerability Audit
Overview
This skill coordinates supply chain security assessment across three dimensions: vulnerability scanning (via real CLI tools), license compliance, and supply chain risk. It delegates CVE detection to actual vulnerability scanners that use live databases — LLM knowledge has a cutoff and cannot reliably detect recent CVEs.
Scanner-to-Ecosystem Mapping
| Manifest | Ecosystem | Scanner | Install |
|---|---|---|---|
package.json |
Node.js | npm audit |
Included with Node.js |
requirements.txt, pyproject.toml, Pipfile |
Python | pip-audit or safety |
pip install pip-audit |
go.mod |
Go | govulncheck |
go install golang.org/x/vuln/cmd/govulncheck@latest |
Cargo.toml |
Rust | cargo audit |
cargo install cargo-audit |
pom.xml |
Java | mvn dependency:analyze |
Apache Maven required |
Gemfile |
Ruby | bundle audit |
gem install bundler-audit |
Important: Non-zero exit codes from vulnerability scanners indicate findings, not errors. Treat scanner exit code != 0 as "vulnerabilities found," not "command failed."