dependency-scanning

To scan for vulnerable dependencies and license compliance issues, the skill analyzes manifest or lock files from your software projects and queries NVD, GitHub Advisory, and OSV databases to produce CVE-based reports and policy violation summaries.

Yes, you can generate a CycloneDX or SPDX SBOM from a multi-language repository by having the skill detect dependencies across ecosystems like Node.js, Python, Java, Go, and Ruby, and then outputting the bill of materials for audit tracking.

Dependency scanning does work with container images and CI/CD pipelines, allowing you to automate security and compliance checks on pull requests to ensure no new vulnerable or non-compliant packages are introduced before merge.

The best way to check third-party libraries for known CVEs and disallowed licenses is to automate vulnerability lookups against NVD, GitHub Advisory, and OSV databases, while simultaneously flagging disallowed licenses to generate policy violation summaries.

Yes, you need manifest or lock files available in your software project to detect security risks, as the dependency scanning process requires these files to accurately identify and evaluate third-party libraries across different ecosystems.