What problem does it solve? Open-source dependencies in manifests like package.json, requirements.txt, go.mod, and pom.xml often contain known vulnerabilities or malicious packages that go unnoticed until they are exploited. This Skill runs a Checkmarx SCA (Software Composition Analysis) scan on dependency manifests and lockfiles, reports vulnerable or malicious packages, and remediates them through the Checkmarx MCP server. ## Core Features & Use Cases - On-demand SCA scanning: Run cx scan oss-realtime against manifests and lockfiles (package.json, yarn.lock, requirements.txt, go.mod, pom.xml, build.gradle, and more) and interpret each package's status (OK, Unknown, Malicious, Vulnerable) with CVE, severity, and location details. - MCP-driven remediation: Every fix comes from the Checkmarx packageRemediation MCP tool, which supplies fixed versions or alternative packages; manual edits, guessed version bumps, and web/registry searches are explicitly forbidden. - Scoped re-scan and suppression: After fixing, the Skill re-scans, remediates only findings tied to changed packages, and suppresses unfixable findings via cx ignore-vulnerability with a structured summary. - Use Case: A developer asks "are my npm packages safe?" The Skill scans package.json, finds a vulnerable lodash version with CVE-2020-8203, obtains the fixed version from the Checkmarx MCP, upgrades only that dependency, and confirms it is clean on re-scan. ## Quick Start Ask the assistant to scan your dependency manifest, for example: "Scan my package.json for vulnerable dependencies and fix any findings."
