What problem does it solve? Open-source dependencies in manifests like package.json, requirements.txt, or go.mod often contain known vulnerabilities or malicious packages that go unnoticed until they cause a breach. This Skill runs a Checkmarx SCA (Software Composition Analysis) scan on dependency files and remediates confirmed findings through the Checkmarx MCP server, so vulnerable packages are identified and fixed without manual CVE research. ## Core Features & Use Cases - On-demand SCA scanning: Runs the Checkmarx cx CLI oss-realtime scan against manifests and lockfiles (package.json, yarn.lock, requirements.txt, go.mod, pom.xml, build.gradle, and more), reporting each package's status, CVEs, severity, and file location. - MCP-driven remediation: Every fix comes from the mcp__Checkmarx__packageRemediation tool — upgrades or removals are applied only to affected dependencies, followed by a re-scan to verify the fix and a structured remediation summary. - Scoped re-scan handling: Distinguishes in-scope findings (packages you changed) from pre-existing ones, preventing version ping-pong loops and uncontrolled edits to unrelated dependencies. - Use Case: A developer asks "are my npm packages safe?" — the Skill scans package.json, flags lodash 4.17.15 with CVE-2020-8203, and on confirmation upgrades it to a fixed version via the Checkmarx MCP, then re-scans to confirm it is clean. ## Quick Start Ask the assistant to scan my package.json for vulnerable dependencies and fix any findings with Checkmarx.
