skills.rest
robotijn
robotijnCOMMUNITY
Explore all skills by this author →
GitHub

dependency-auditor

Scan transitive dependencies for vulnerabilities and generate signed SBOMs.

3|2|Updated Jan 23, 2026
Search Tags:#vulnerability detection#supply chain security#license compliance#dependency scanning#typosquat detection#SBOM generation#CVE correlation
One-click install
npx skills add https://github.com/robotijn/ctoc --skill dependency-auditor-robotijn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-auditor
Source: https://github.com/robotijn/ctoc/tree/main/skills/security/dependency-auditor
Command: npx skills add https://github.com/robotijn/ctoc --skill dependency-auditor-robotijn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Unvetted dependencies introduce critical security vulnerabilities, license compliance violations, and supply chain attack vectors into software projects, leading to data breaches, legal liability, and operational downtime that could be avoided with proactive scanning.

Core Features & Use Cases

  • Multi-feed CVE correlation: Aggregates vulnerability data from OSV, GHSA, NVD, CISA KEV, and ecosystem-native feeds to eliminate blind spots from single-source scanners.
  • Reachability-aware prioritization: Ranks flaws by actual exploitability using call-graph analysis, EPSS exploitation probability, and CISA KEV active exploit status to reduce alert fatigue.
  • Supply chain hygiene checks: Detects typosquats, dependency confusion attacks, malicious post-install hooks, and unmaintained packages before they reach production.
  • Compliance and attestation: Generates signed SBOMs (CycloneDX and SPDX) with SLSA provenance for regulatory and supply chain compliance requirements. Use case: A fintech team running a Python microservices stack can use this skill to perform a nightly full transitive audit, flag a reachable critical CVE in a transitive requests dependency, and generate a signed SBOM for their SOC 2 audit trail.

Quick Start

Use the dependency-auditor skill to run a full transitive vulnerability scan of your project's dependencies and generate a signed SBOM for your next release.

Frequently Asked Questions about dependency-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan dependencies for CVEs and supply chain risks?▼

Scanning dependencies for CVEs involves correlating transitive dependency graphs against OSV, GHSA, NVD, and CISA KEV feeds to identify vulnerabilities, typosquats, and malicious hooks across npm, PyPI, Maven, and other package ecosystems.

How does reachability analysis prioritize exploitable flaws in transitive dependencies?▼

Reachability analysis prioritizes exploitable flaws by combining call-graph analysis with EPSS exploitation probability and CISA KEV active exploit status, reducing alert fatigue by ranking vulnerabilities based on actual exploitability rather than theoretical severity.

Can I generate signed SBOMs with SLSA provenance for SOC 2 compliance?▼

Generating signed SBOMs with SLSA provenance for SOC 2 compliance is supported by producing CycloneDX and SPDX formats, providing regulatory and supply chain attestation for full transitive dependency audits in CI/CD pipelines.

Does dependency scanning work with multiple package ecosystems like Cargo and NuGet?▼

Dependency scanning works with major package ecosystems including npm, PyPI, Maven, NuGet, Cargo, and Go, applying full transitive vulnerability checks and supply chain hygiene across diverse software project stacks.

What is the best way to detect typosquat and dependency confusion attacks before release?▼

Detecting typosquat and dependency confusion attacks before release is best handled through supply chain hygiene checks that flag malicious post-install hooks, unmaintained packages, and suspicious registry entries during pre-release or nightly audit scans.

Why does multi-feed CVE correlation eliminate blind spots found in single-source scanners?▼

Multi-feed CVE correlation eliminates blind spots by aggregating vulnerability data across OSV, GHSA, NVD, EPSS, and ecosystem-native feeds, ensuring comprehensive coverage that single-source scanners miss during transitive dependency audits.

Related Skills

Explore More Software Engineering Skills→
lookatitudelookatitude
6

security-dependency-audit

Scan dependencies for CVEs and license risks, then output an audit-report.md and patch plan.

Community
Advanced
woohyun212woohyun212
21

supply-chain-audit

Audit software supply chains with SCA scans, SLSA matrices, and SBOMs.

Community
Advanced
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-scan-full

Construct a full call graph to identify exploitable security vulnerabilities in a codebase.

Official
Advanced
LeoWSY-hashblueLeoWSY-hashblue
3

cve-poc-generator

Generate Python PoC scripts and markdown reports from CVE IDs.

Community
Advanced