dependency-scanning

Scan project dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check.

46|4|Updated Jan 27, 2026

Search Tags:#Snyk #vulnerability management #Dependabot #SCA #dependency scanning #software supply chain #OWASP Dependency-Check

Ready to run

npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill dependency-scanning-bagelhole

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dependency-scanning
Source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/scanning/dependency-scanning
Command: npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill dependency-scanning-bagelhole

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need to identify and remediate vulnerabilities within third-party libraries and dependencies, thereby securing the software supply chain.

Core Features & Use Cases

Vulnerability Detection: Scans project dependencies using tools like Snyk, Dependabot, and OWASP Dependency-Check to find known security flaws.
Remediation Guidance: Provides information on how to fix identified vulnerabilities, including automated patching options.
Use Case: When integrating a new open-source library into your project, use this Skill to ensure it doesn't introduce known security risks before deployment.

Quick Start

Use the dependency-scanning skill to scan the current project's npm dependencies for high-severity vulnerabilities.

Frequently Asked Questions about dependency-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan project dependencies for known vulnerabilities in my software supply chain?▼

To scan project dependencies for known vulnerabilities, you need to provide package manifest files and access to scanning tools. The skill analyzes these manifests to identify and remediate vulnerable libraries.

Does this dependency scanning skill work with Snyk, Dependabot, and OWASP Dependency-Check?▼

Yes, the dependency scanning skill works with Snyk, Dependabot, and OWASP Dependency-Check. It leverages these tools to detect security flaws and provide remediation guidance for your project.

What is the best way to integrate vulnerability management into my CI/CD pipeline?▼

The best way to integrate vulnerability management into CI/CD pipelines is by scanning dependencies during the build process. This skill identifies vulnerable libraries and provides automated patching options before deployment.

How do I remediate vulnerable libraries identified during software supply chain scanning?▼

To remediate vulnerable libraries identified during software supply chain scanning, you follow the provided remediation guidance. The skill offers information on how to fix flaws, including automated patching options.

Do I need package manifest files to perform SCA and detect security risks?▼

Yes, you need package manifest files to perform SCA and detect security risks. The skill requires these manifests as input to scan your project dependencies using tools like Snyk and Dependabot.

When should I use dependency scanning to check a new open-source library?▼

You should use dependency scanning to check a new open-source library before integrating it into your project. This ensures the library does not introduce known security risks into your software supply chain.