skills.rest
ClearMeasureLabs
ClearMeasureLabsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

owasp-dependency-scan

Scan .NET and npm dependencies for disclosed CVEs and generate consolidated security reports.

3|2|Updated Aug 1, 2025
Search Tags:#security#vulnerability#audit#supply-chain#cve#dependency
One-click install
npx skills add https://github.com/ClearMeasureLabs/bootcamp-palermo-workorders --skill owasp-dependency-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: owasp-dependency-scan
Source: https://github.com/ClearMeasureLabs/bootcamp-palermo-workorders/tree/main/.claude/skills/owasp-dependency-scan
Command: npx skills add https://github.com/ClearMeasureLabs/bootcamp-palermo-workorders --skill owasp-dependency-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires docker, java, dotnet, npm, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill addresses the critical security risk of vulnerable third-party dependencies in .NET and Node.js projects by automating the detection of known CVEs across both direct and transitive packages.

Core Features & Use Cases

  • Multi-Ecosystem Scanning: Simultaneously audits NuGet and npm packages using native tools and the OWASP Dependency-Check engine.
  • Prioritized Reporting: Consolidates findings into a single, severity-ranked report that highlights critical vulnerabilities and provides actionable upgrade paths.
  • CI/CD Gating: Supports automated build failure thresholds based on CVSS scores to prevent the introduction of high-risk dependencies into production.

Quick Start

Run the owasp dependency scan skill on the current directory to identify and report all vulnerable packages.

Frequently Asked Questions about owasp-dependency-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan .NET and npm projects for vulnerable dependencies and known CVEs?▼

To automate CVE audits for supply-chain risk assessment, use the OWASP Dependency-Check engine with native dotnet and npm audit scanners. It identifies known vulnerabilities in direct and transitive packages, producing a consolidated severity-ranked report with actionable upgrade paths.

Can I fail a CI/CD build automatically based on dependency vulnerability severity?▼

Yes, you can gate CI/CD builds by configuring automated failure thresholds based on CVSS scores. This prevents the introduction of high-risk vulnerable dependencies into production environments by failing the pipeline when critical CVEs are detected.

Does the OWASP dependency scan work with both NuGet and npm packages?▼

Yes, the OWASP dependency scan supports multi-ecosystem scanning for both NuGet and npm packages. It simultaneously audits .NET and Node.js projects by orchestrating the OWASP Dependency-Check engine with native dotnet and npm audit scanners.

What do I need to set up before running an automated CVE audit on my project?▼

Before running automated CVE audits, ensure Docker, Java, dotnet, and npm are installed and configured in your environment. These dependencies are required to orchestrate the OWASP Dependency-Check engine and execute the native package audit scanners.

How are security vulnerabilities prioritized in the consolidated audit report?▼

Security vulnerabilities are prioritized in the consolidated audit report using severity rankings based on CVSS scores. The report highlights critical CVEs found in third-party dependencies and provides actionable upgrade paths for remediation.

Related Skills

Explore More Software Engineering Skills→
Razmik-KutinavaRazmik-Kutinava

Dependency Security Check Expert

Automate dependency vulnerability scanning and mitigation across Node.js, Python, Java, and Go.

Community
Advanced
camelranchentertainmentcamelranchentertainment
1

security-reviewer

Identify security vulnerabilities in code, dependencies, and configurations.

Community
Advanced
jeremylongshorejeremylongshore
2.6k

scanning-container-security

Scan container images and running containers for vulnerabilities using Trivy or Snyk.

Community
Intermediate
kfolkeskfolkes
2

dependency-check-security-scan

Scan project dependencies for known CVEs using OWASP Dependency-Check.

Community
Intermediate