dependency-audit

To scan project dependencies for known vulnerabilities, this tool automatically detects Node.js, Python, Go, or container projects and aggregates a security report. It identifies vulnerable packages across ecosystems to prevent security breaches.

The best way to run a dependency audit across multiple ecosystems is using an automated detection tool that triggers npm audit for Node.js and pip-audit for Python. It produces an aggregated summary with severity breakdowns and remediation guidance.

Yes, you need the relevant tools like npm audit, pip-audit, and trivy installed on your system before scanning. You must also set the SECSKILL_PROJECT_PATH environment variable to define the target project directory for the vulnerability scan.

Yes, dependency scanning supports Go and container projects by utilizing trivy. The scanner automatically determines which security tool to run based on the presence of specific project files in your directory.

To get remediation guidance after detecting vulnerable packages, run an aggregated dependency scan. The tool produces a summary with a severity breakdown and actionable remediation steps to help you resolve the identified vulnerabilities.