dependency-scanning

To scan dependencies and generate an SBOM, provide your dependency manifests or lockfiles. The skill identifies vulnerabilities across direct and transitive packages and produces an SBOM-aligned assessment using CycloneDX or SPDX concepts.

Triage CVEs by combining EPSS exploit likelihood, CVSS base scores, and CISA KEV known exploitation data. This approach prioritizes remediation based on actual risk and active threats in the wild, moving beyond static severity ratings.

Dependency scanning checks license compliance by flagging copyleft and unlicensed packages. It also highlights supply chain integrity issues, detecting typosquatting and dependency-confusion indicators across your project dependencies.

Yes, you can use a lockfile to prepare a release. The skill processes lockfiles or manifests to map transitive dependencies, assess vulnerability risks, and output a structured remediation report for your build and release workflows.

An SBOM-focused assessment inventories direct and transitive dependencies using standards like CycloneDX or SPDX. You need it during release preparation to ensure no known CVEs, risky licenses, or supply chain attacks silently reach production.