auditing-transitive-vulnerabilities

What problem does it solve?

This Skill helps you audit resolved dependency graphs for transitive vulnerabilities so you can distinguish real exposure from low-priority noise in deep supply chains.

Core Features & Use Cases

• Scans SBOMs or lockfiles with a real vulnerability scanner instead of relying on direct-dependency checks.
• Traces dependency paths, enriches findings with EPSS, and weighs reachability plus depth so the riskiest issues rise to the top.
• Guides remediation with upgrade, override, replace, and suppression options that keep the review auditable.
• Use it when a downstream scanner flags a package you did not install directly, when a clean direct scan feels suspicious, or when you need a defensible fix-or-suppress decision.

Quick Start

Ask this Skill to audit your SBOM or lockfile for transitive vulnerabilities, rank the findings by severity, reachability, EPSS, and depth, and recommend the safest remediation for each top issue.