dependency-vulnerability-scanner

Dependency vulnerability scanning identifies risky packages in your project by running language-specific audit tools like npm audit, pip-audit, or bundler-audit against your dependency manifests and lockfiles. The Skill executes the appropriate tool for your tech stack and produces a structured report with severity levels and recommended fixes.

Vulnerability scanning covers Node.js (npm/yarn), Python (pip-audit, safety), Ruby (bundler-audit), Go (go mod), and Rust (Cargo). Each language ecosystem has dedicated audit tools that check against CVE databases and output actionable remediation steps.

Automated scanning runs on a schedule—weekly or per-commit—to continuously monitor dependencies for new CVEs. The Skill generates structured reports in JSON or markdown format that surface critical vulnerabilities and suggested package upgrades before they reach production.

Yes, vulnerability reports include recommended fixes and upgrade paths for each identified CVE. The output specifies the vulnerable version range, severity level, and the patched version you should upgrade to, enabling immediate remediation decisions.

Dependency auditing focuses specifically on known vulnerabilities in third-party packages listed in your manifest files. Unlike code scanning, it targets the supply chain risk from libraries your project relies on, catching publicly disclosed CVEs before they're exploited.