Dependency Scanning

Identify vulnerabilities in third-party dependencies and libraries.

When to Use This Skill

Use this skill when:

• Managing third-party dependencies
• Implementing software composition analysis
• Meeting compliance requirements
• Securing the software supply chain
• Automating vulnerability detection

Scan and exception boundaries

Inventory every relevant manifest/lockfile, including nested projects; a clean root scan does not cover them. Review tools at fixed versions and scan with lifecycle scripts disabled where supported. Some scanners upload dependency metadata or source, so confirm permitted data/account scope. fix, --force, ignores and suppressions mutate dependencies or policy: review diffs and test before adopting them. Historical suppression IDs/dates are examples, never reusable approval; bind each real exception to evidence, owner and expiry. A missing vulnerable-function call is not automatically a false positive or a license exemption.

Prerequisites