skills.rest
alxayo
alxayoCOMMUNITY
Explore all skills by this author →
GitHub

dependency-check-security-scan

Identify known CVEs in project dependencies using OWASP Dependency-Check.

17|5|Updated Feb 1, 2026
Search Tags:#vulnerability#supply-chain#ci-cd#cve#dependency-check#sca
One-click install
npx skills add https://github.com/alxayo/sec-check --skill dependency-check-security-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-check-security-scan
Source: https://github.com/alxayo/sec-check/tree/main/.github/skills/dependency-check-security-scan
Command: npx skills add https://github.com/alxayo/sec-check --skill dependency-check-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps development teams quickly identify known CVEs in project dependencies to prevent deploying vulnerable software.

Core Features & Use Cases

  • CVE detection across Java, .NET, JavaScript, Python, Ruby, and Go ecosystems
  • Generates reports in HTML, JSON, SARIF formats for CI/CD integration
  • Supports suppression files and sources including NVD, CISA KEV, OSS Index, and RetireJS
  • Ideal for dependency audits, security gates, compliance scanning, and SBOM workflows

Quick Start

Run dependency-check.sh --scan ./ --out ./reports to scan your project dependencies and produce vulnerability reports.

Frequently Asked Questions about dependency-check-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan project dependencies for known CVEs in a CI/CD pipeline?▼

This Skill checks project dependencies against the NVD to identify known CVEs, supporting Java, .NET, JavaScript, Python, Ruby, and Go ecosystems for security compliance workflows.

Can I generate SARIF reports from dependency scanning for security gates?▼

Yes, dependency scanning supports SARIF output alongside HTML and JSON, enabling direct integration of vulnerability findings into CI/CD security gates and compliance workflows.

Does OWASP Dependency-Check work for Python and Go dependency audits?▼

Yes, OWASP Dependency-Check supports Python and Go projects alongside Java, .NET, JavaScript, and Ruby, pulling vulnerability data from NVD, CISA KEV, OSS Index, and RetireJS.

How do I use suppression files to handle false positives in CVE detection?▼

Suppression files allow you to exclude specific false positive findings during CVE detection, ensuring vulnerability reports contain only actionable threats relevant to your actual project dependencies.

What's the best way to audit dependencies for CISA KEV vulnerabilities?▼

Auditing dependencies using the CISA KEV catalog as a data source helps identify known exploited vulnerabilities, which this scanning tool integrates alongside NVD and OSS Index checks for supply-chain security.

Related Skills

Explore More Software Engineering Skills→
Tonybleything76Tonybleything76

Dependency Auditor

Analyze software dependencies for security vulnerabilities and license compliance.

Community
Advanced
igbuendigbuend
8

depscan

Execute OWASP Depscan for software composition analysis and generate SBOM, VEX, and SARIF reports.

Community
Advanced
ImaginerLabsImaginerLabs

security-auditor

Detect source code, dependency, and configuration security vulnerabilities with prioritized OWASP remediation steps.

Official
Advanced
mindcockpit-aimindcockpit-ai
11

lint-debt

Scan lint suppression comments and sync them with GitHub issues.

Official
Advanced