skills.rest
ToanPV90
ToanPV90COMMUNITY
Explore all skills by this author →
GitHub

dependency-scanning

Scan installed packages and manifest files for known vulnerabilities.

Updated Apr 15, 2026
Search Tags:#Snyk#vulnerabilities#Dependabot#CI/CD security#SBOM#dependency scanning#OWASP Dependency-Check
One-click install
npx skills add https://github.com/ToanPV90/dotfiles --skill dependency-scanning-toanpv90
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-scanning
Source: https://github.com/ToanPV90/dotfiles/tree/main/agents/.agents/skills/dependency-scanning
Command: npx skills add https://github.com/ToanPV90/dotfiles --skill dependency-scanning-toanpv90

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Dependency scanning helps you detect known vulnerabilities in third-party packages so you can reduce exposure in your software supply chain before those issues reach production.

Core Features & Use Cases

  • Vulnerability detection across ecosystems: Scan Node, Python, containers, and more to surface known CVEs from multiple sources and scanners.
  • Actionable workflows: Use Snyk, Dependabot, and OWASP Dependency-Check to generate reports, automate fixes, and manage remediation.
  • Compliance-ready outputs: Produce machine-readable results (e.g., JSON/SARIF) and generate SBOMs for governance and audit trails.
  • Use Case: If a CI run suddenly starts flagging a high-severity CVE in a transitive dependency, use this skill to identify the package, confirm impact, and plan remediation while keeping SBOM/report artifacts for traceability.

Quick Start

Run a high-severity dependency scan of your project using a tool such as Snyk or OWASP Dependency-Check and export the results for review in your CI workflow.

Frequently Asked Questions about dependency-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is dependency scanning and how does it find vulnerable libraries?▼

Dependency scanning identifies known vulnerabilities in third-party software by scanning installed packages and manifest files. It compares your dependencies against known CVE databases to detect security issues before they reach production environments.

How do I integrate vulnerability scanning into a CI/CD pipeline?▼

You can integrate vulnerability scanning into CI/CD pipelines by running automated security checks using tools like Snyk, Dependabot, or OWASP Dependency-Check. These tools scan dependencies during builds and produce structured outputs to support tracking and remediation workflows.

Can I generate an SBOM from my project dependencies for compliance?▼

Yes, dependency scanning can generate Software Bill of Materials (SBOM) artifacts for governance and audit trails. Scanners produce machine-readable formats like JSON and SARIF alongside the SBOM to support compliance workflows and traceability.

Does dependency scanning work for containers and backend services?▼

Yes, dependency scanning applies to software composition analysis for web apps, backend services, and containers. It scans installed packages and manifest files across multiple ecosystems like Node and Python to surface known CVEs.

What is the best way to handle a high-severity CVE flagged in a transitive dependency?▼

Use dependency scanning to identify the flagged package, confirm its impact, and plan remediation. Scanning tools like Snyk or OWASP Dependency-Check can automate fixes and generate report artifacts for traceability while you resolve the vulnerability.

Related Skills

Explore More Software Engineering Skills→
endorlabsendorlabs
4

endor-dependency-provenance

Resolve package-version provenance by manifest path and source ref or sha.

Official
Intermediate
rohunjrohunj
232

sca-trivy

Scan container images, dependencies, and IaC for CVEs using Trivy.

Community
Advanced
kagentikagenti
292

cve:scan

Scan project dependencies and source code for CVEs using Trivy.

Official
Advanced
7a336e6e7a336e6e
1

auditing-dependencies

Analyze third-party libraries for vulnerabilities and supply chain risks.

Community
Intermediate