skills.rest
igbuend
igbuendCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

depscan

Execute OWASP Depscan for software composition analysis and generate SBOM, VEX, and SARIF reports.

8|1|Updated Jan 19, 2026
Search Tags:#vulnerability analysis#license compliance#sbom#sca#dependency scanning#vex
One-click install
npx skills add https://github.com/igbuend/grimbard --skill depscan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: depscan
Source: https://github.com/igbuend/grimbard/tree/main/skills/depscan
Command: npx skills add https://github.com/igbuend/grimbard --skill depscan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires owasp-dep-scan, cdxgen, sarif-tools, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need for comprehensive Software Composition Analysis (SCA) by identifying vulnerabilities, managing licenses, and generating essential security documents like SBOMs and VEX.

Core Features & Use Cases

  • Advanced SCA: Goes beyond basic dependency scanning to include vulnerability data, license compliance, and risk assessment.
  • SBOM & VEX Generation: Creates Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) documents crucial for supply chain security and compliance.
  • Use Case: A development team needs to ensure their new application is free from known vulnerabilities in its open-source dependencies and must provide an SBOM to their security team. This Skill can perform the scan, generate the SBOM, and highlight critical vulnerabilities with actionable remediation steps.

Quick Start

Run a full OWASP Depscan audit on the current project directory, generating SARIF, JSON, and HTML reports, and enabling risk auditing and license scanning.

Frequently Asked Questions about depscan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an SBOM and run vulnerability scanning for my project dependencies?▼

Software Composition Analysis identifies vulnerabilities and manages license compliance in open-source dependencies. This approach executes OWASP Depscan to assess risk, generate SBOMs, and produce VEX documents for comprehensive supply chain security.

Can I audit license compliance and assess risk scores across different package managers?▼

You can generate a VEX document by running a dependency scan with vulnerability analysis enabled. The VEX document is created alongside the SBOM, providing details on vulnerability exploitability for supply chain security and compliance reporting.

What report formats are supported for dependency scanning and SCA results?▼

Yes, you can use this approach for supply chain security by generating SBOMs and VEX documents during the dependency scan. It highlights critical vulnerabilities with actionable remediation steps, ensuring your application is free from known issues.

Do I need to install OWASP Depscan separately to perform Software Composition Analysis?▼

You do not need to install OWASP Depscan separately to perform Software Composition Analysis. The Skill integrates the necessary dependencies, including owasp-dep-scan, cdxgen, and sarif-tools, to execute the scan and generate reports automatically.

Related Skills

Explore More Software Engineering Skills→
crgarcia12crgarcia12

dependency-inventory

Extract and catalog project dependencies from package manifests and lock files.

Community
Advanced
I-OnlabsI-Onlabs
3

senior-secops

Run security scanner, vulnerability assessor, and compliance checker scripts with JSON reports.

Community
Advanced
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-sbom

Export, import, analyze, and compare CycloneDX or SPDX SBOMs.

Official
Advanced
luissimon96luissimon96

graph-dependency

Audit dependencies, generate SBOMs, and check license compliance for software projects.

Community
Advanced