dependency-scan

Scan project dependencies for vulnerabilities, outdated packages, and license issues.

53|1|Updated Dec 18, 2025

Search Tags:#license #vulnerabilities #ecosystem #SBOM #upgrades #dependency-scan

Ready to run

npx skills add https://github.com/cosmix/claude-code-setup --skill dependency-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dependency-scan
Source: https://github.com/cosmix/claude-code-setup/tree/main/skills/dependency-scan
Command: npx skills add https://github.com/cosmix/claude-code-setup --skill dependency-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Scans project dependencies for known vulnerabilities, outdated packages, and license compliance issues. This skill covers multiple ecosystems and provides remediation guidance.

Core Features & Use Cases

Vulnerability Scanning: CVE checks and patch recommendations.
Licensing & Upgrades: License compliance and upgrade paths.
SBOM & Reporting: Dependency inventories and actionable reports.

Quick Start

Run a dependency scan with your package manager and plan upgrades for high-risk packages.

Frequently Asked Questions about dependency-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan project dependencies for vulnerabilities and security issues?▼

Dependency scanning identifies known CVEs, outdated packages, and security risks across your project's dependencies. The skill parses manifests and dependency trees to detect vulnerabilities in direct and transitive dependencies, then recommends patches and upgrade paths to remediate them.

What package ecosystems does dependency scanning support?▼

Dependency scanning covers Node.js, Python, Rust, Go, Ruby, Java/Maven, .NET, and PHP ecosystems. It distinguishes direct from transitive dependencies and identifies phantom dependencies, providing comprehensive vulnerability assessment across multiple languages and package managers.

Can I check license compliance as part of dependency scanning?▼

Yes, dependency scanning flags license compliance issues alongside vulnerabilities. It assesses all dependencies for licensing concerns and provides upgrade guidance to help you maintain compliance across your project's entire dependency tree.

How do I get an SBOM and upgrade recommendations from dependency scanning?▼

Dependency scanning generates a complete Software Bill of Materials (SBOM) and produces actionable upgrade paths for high-risk packages. The output includes remediation guidance and exploitability assessment to guide your patching strategy.

Does dependency scanning distinguish between direct and transitive dependencies?▼

Yes, dependency scanning explicitly differentiates direct dependencies you explicitly require from transitive dependencies pulled in by your direct dependencies. This distinction helps prioritize remediation efforts on vulnerabilities in your direct supply chain.