dependency-cve-audit

What problem does it solve?

This Skill eliminates the risk of blocked merges and releases caused by critical or high severity CVE vulnerabilities in project dependencies, especially for teams using Bun, npm, or monorepos where standard audit tools fail to work correctly. It also avoids wasted effort from false positive CVE results caused by stale lockfiles, and provides clear migration paths for unmaintained packages with no available security fixes.

Core Features & Use Cases

• Cross-ecosystem CVE scanning: Supports npm, Bun, Yarn, and pnpm projects, including monorepos with multiple lockfiles, using osv-scanner to read all common lockfile formats.
• Stale audit result detection: Includes guardrails to identify false positive CVEs from outdated lockfiles, avoiding unnecessary migration work.
• Unmaintained package remediation: Provides step-by-step migration guidance for packages with no available security fixes, including code rewrite examples and verification steps.
• Transitive dependency fixes: Teaches how to use package.json overrides to fix vulnerabilities in indirect dependencies without polluting root dependency lists.
• Use Case: A team using Bun for their backend and npm for their frontend can run a full pre-merge CVE audit, catch a high severity vulnerability in an unmaintained xlsx package, migrate to exceljs, and pass their red line 18 security requirement to ship code.

Quick Start

Use the dependency-cve-audit skill to run a full CVE scan of your project's dependencies, resolve any critical or high severity vulnerabilities including stale lockfile false positives and unmaintained package migrations, and meet your team's pre-merge security requirements.