skills.rest
kfolkes
kfolkesCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

dependency-check-security-scan

Scan project dependencies for known CVEs using OWASP Dependency-Check.

2|Updated Mar 11, 2026
Search Tags:#security#vulnerability#owasp#cve#sca#dependency scanning
One-click install
npx skills add https://github.com/kfolkes/dotnet-modernization-db-transform --skill dependency-check-security-scan-kfolkes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-check-security-scan
Source: https://github.com/kfolkes/dotnet-modernization-db-transform/tree/main/sec-check/.github/skills/dependency-check-security-scan
Command: npx skills add https://github.com/kfolkes/dotnet-modernization-db-transform --skill dependency-check-security-scan-kfolkes

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies known security vulnerabilities (CVEs) within your project's third-party dependencies, helping you mitigate risks before deployment.

Core Features & Use Cases

  • Software Composition Analysis (SCA): Scans Java, .NET, JavaScript, Python, Ruby, Go, and PHP projects for vulnerable libraries.
  • Vulnerability Detection: Leverages OWASP Dependency-Check against NVD, CISA KEV, OSS Index, and RetireJS databases.
  • Use Case: Before merging a pull request, run this Skill to automatically scan all npm dependencies for critical CVEs and fail the build if any are found with a CVSS score of 7 or higher.

Quick Start

Run a security scan on your project's dependencies and generate an HTML report.

Frequently Asked Questions about dependency-check-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan project dependencies for known CVEs before deployment?▼

To scan project dependencies for known CVEs, this Skill performs Software Composition Analysis using OWASP Dependency-Check against NVD, CISA KEV, OSS Index, and RetireJS databases to identify vulnerable third-party libraries.

Can I scan npm dependencies and fail the build if critical vulnerabilities are found?▼

Yes, you can scan npm dependencies and fail the build if critical vulnerabilities are found. This Skill detects CVEs and can enforce CI/CD security gates based on CVSS score thresholds like 7 or higher.

Does dependency vulnerability scanning work with Python, Go, and PHP projects?▼

Dependency vulnerability scanning works with Python, Go, and PHP projects, alongside Java, .NET, JavaScript, and Ruby, providing Software Composition Analysis for multiple language ecosystems.

What is the best way to check third-party libraries for CISA KEV vulnerabilities?▼

The best way to check third-party libraries for CISA KEV vulnerabilities is using this Skill's OWASP Dependency-Check integration, which cross-references dependencies against the CISA KEV catalog and other vulnerability databases.

How do I generate an HTML report of vulnerable dependencies in my application?▼

You can generate an HTML report of vulnerable dependencies by running this Skill's security scan, which analyzes your project's libraries and outputs a detailed report of detected CVEs and supply chain risks.

Why use Software Composition Analysis instead of just static code analysis?▼

Software Composition Analysis identifies known CVEs in third-party dependencies, whereas static code analysis focuses on your own code, making SCA necessary for comprehensive supply chain risk assessment and vulnerability detection.

Related Skills

Explore More Software Engineering Skills→
micaelmaltamicaelmalta
1

dependencies

Automate dependency upgrades and lockfile synchronization across Node, Python, Go, Rust, and Ruby projects.

Community
Intermediate
kagentikagenti
292

cve

Scan project dependencies, source code, and documentation for known CVEs.

Official
Advanced
nickromneynickromney

Setup Security Scanning

Configure security scanning for codebases and CI/CD pipelines.

Community
Advanced
DCx7C5DCx7C5

sca-SKILL.md

Automate Snyk-based scans of package manifests and lockfiles in CI/CD pipelines.

Community
Advanced