skills.rest
RuoJi6
RuoJi6COMMUNITY
Explore all skills by this author →
WebsiteGitHub

java-vuln-scanner

Detect known Java component vulnerabilities in Maven, Gradle, or JAR dependencies.

993|101|Updated Jan 23, 2026
Search Tags:#vulnerability#dependencies#java#CVE#report#scan
One-click install
npx skills add https://github.com/RuoJi6/java-audit-skills --skill java-vuln-scanner
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: java-vuln-scanner
Source: https://github.com/RuoJi6/java-audit-skills/tree/main/skills/java-vuln-scanner
Command: npx skills add https://github.com/RuoJi6/java-audit-skills --skill java-vuln-scanner

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml.

What problem does it solve?

Detect known Java component vulnerabilities in Maven, Gradle, and JAR dependencies to prevent insecure software from shipping.

Core Features & Use Cases

  • Module-scoped scanning: Analyzes pom.xml, build.gradle, and JAR metadata to enumerate dependencies by module.
  • CVE-based risk detection: Applies a ruleset of CVE patterns to flag vulnerable components and generate a detailed report.
  • Output formats: Produces Markdown and JSON scan reports suitable for auditing, remediation tracking, and integration.

Quick Start

  • Run the vulnerability scan on a Java project by pointing to the root directory containing pom.xml/build.gradle and JARs, using the rules file at references/java-vulnerability.yaml.
  • Example command: python3 scripts/scan_dependencies.py /path/to/java-project --rules references/java-vulnerability.yaml --no-deps

Frequently Asked Questions about java-vuln-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Java dependencies for known CVE vulnerabilities?▼

To scan Java dependencies for CVE vulnerabilities, parse pom.xml, build.gradle, or JAR metadata using a ruleset to match known vulnerable components and generate a structured report.

Can I detect vulnerabilities in compiled JAR files or only Maven and Gradle projects?▼

Vulnerability detection supports compiled JAR files alongside Maven and Gradle projects by parsing JAR metadata, enumerating dependencies by module, and matching them against CVE patterns.

How do I generate a vulnerability report for a multi-module Maven project?▼

Generate a vulnerability report for a multi-module Maven project by pointing the scanner to the root directory containing pom.xml, grouping detected CVE risks by module, and outputting Markdown or JSON.

What output formats are available for Java dependency vulnerability reports?▼

Java dependency vulnerability reports are available in both Markdown and JSON formats, making them suitable for security auditing, remediation tracking, and CI/CD pipeline integration.

Does the Java vulnerability scanner require an internet connection to check CVEs?▼

The Java vulnerability scanner applies a local ruleset file, such as references/java-vulnerability.yaml, to match CVE patterns against dependencies, eliminating the need for an external internet connection.

Related Skills

Explore More Software Engineering Skills→
AzureAzure
2.6k

search-m2

Search local Maven repository JAR files for Java classes and resolve dependency coordinates.

Official
Intermediate
josavicentevwjosavicentevw
1

devsecops

Automate security scanning and governance across CI/CD pipelines and compliance workflows.

Community
Advanced
transilienceaitransilienceai
462

cve-testing

Coordinate CVE vulnerability testing across identified technology stacks and APIs.

Official
Basic
leonardoteodorooleonardoteodoroo

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for CI/CD security scanning.

Community
Advanced