Detect known CVEs in project dependencies using native package manager audit tools.
npx skills add https://github.com/softspark/ai-toolkit --skill cve-scan-softspark
Please help me install this Agent Skill. Skill: cve-scan Source: https://github.com/softspark/ai-toolkit/tree/main/app/skills/cve-scan Command: npx skills add https://github.com/softspark/ai-toolkit --skill cve-scan-softspark
Many projects use multiple package managers, and manually tracking known security vulnerabilities across them is error‑prone and time‑consuming.
npm audit, pip-audit) without installing third‑party scanners.--fix flag is supplied.Use case example: a mixed‑language web service that includes a Node front‑end and a Python back‑end can be scanned in a single command to surface any vulnerable packages before deployment.
Run the cve-scan skill to audit all dependencies in the current project and receive a concise vulnerability report.
High-intent search queries and answers about installing and using this skill.
To scan dependencies for vulnerabilities across multiple ecosystems, the skill automatically detects npm, pip, composer, cargo, go, bundler, and dart manifests, then runs native audit commands to produce a unified severity-sorted report.
Yes, you can fix vulnerable dependencies by supplying the --fix flag, which instructs the skill to execute each package manager's built-in automatic fix commands to update affected packages.
To detect CVEs, you need native audit tools installed such as npm audit, pip-audit, composer audit, cargo audit, govulncheck, bundle-audit, and dart pub outdated for the skill to execute.
When a required audit tool is missing during a vulnerability scan, the skill gracefully handles it by reporting the missing utility and providing install hints instead of failing the entire process.
Yes, the vulnerability scanner works with mixed-language repositories by detecting and auditing both Node and Python dependencies, merging findings into a single severity-sorted report with optional JSON output.
Automatic ecosystem detection works by identifying package manifests like package.json, requirements.txt, or Cargo.toml in the repository, allowing the skill to run the corresponding native audit commands without manual configuration.
fusengineAudit project dependencies for known security vulnerabilities using ecosystem-specific tools.
Logisoft-webScan code repositories for vulnerabilities in dependencies, secrets, and configurations.
brenordvAudit software systems for security vulnerabilities and regulatory compliance.
statick88Automate vulnerability detection across code, dependencies, containers, and infrastructure.