skills.rest
Vulnetix
VulnetixOFFICIAL
Explore all skills by this author →
WebsiteGitHub

package-search

Identify risky dependencies by matching repository ecosystems against Vulnetix VDB vulnerability data.

9|1|Updated Mar 24, 2026
Search Tags:#security#dependencies#risk-assessment#lockfiles#upgrades#vdb#package-search
One-click install
npx skills add https://github.com/Vulnetix/pix-ai-coding-assistant --skill package-search-vulnetix
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: package-search
Source: https://github.com/Vulnetix/pix-ai-coding-assistant/tree/main/vulnetix/skills/package-search
Command: npx skills add https://github.com/Vulnetix/pix-ai-coding-assistant --skill package-search-vulnetix

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The skill helps developers identify safe package choices by assessing current dependencies against vulnerability data and upgrade options.

Core Features & Use Cases

  • Analyze ecosystems detected in the repository (npm, go, pypi, etc.) and surface risk signals for candidate packages
  • Provide clear upgrade paths with version context and CWSS-like risk scoring
  • Generate ready-to-apply diffs or commands to update dependency declarations

Quick Start

Ask the AI to search for packages matching your term and review the risk insights before upgrading.

Frequently Asked Questions about package-search

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check dependencies for vulnerabilities before upgrading?▼

The Skill scans lockfiles or manifests in detected ecosystems, matches current package versions against the Vulnetix VDB for vulnerability data, and calculates a safeHarbour score to identify risky dependencies before you upgrade.

What is the best way to find safe package upgrades with risk insights?▼

The best way to find safe package upgrades is to analyze current project versions against real-time vulnerability data, which surfaces upgrade paths, vulnerability counts, maxSeverity, and safeHarbour scores for each candidate package.

Can I analyze lockfiles from multiple ecosystems like npm and pypi?▼

Yes, you can analyze lockfiles from multiple ecosystems. The Skill detects ecosystems in the repository, including npm, go, and pypi, to surface risk signals and provide upgrade paths for candidate packages across different environments.

How do I get ready-to-apply edits for dependency updates?▼

To get ready-to-apply edits for dependency updates, the Skill generates proposed edits and commands to update dependency declarations after analyzing current versions and calculating safeHarbour risk scores.

Does package-search work without external vulnerability database access?▼

No, package-search requires external vulnerability database access. It matches the repository's detected ecosystems against real-time vulnerability data from the Vulnetix VDB to identify risky dependencies and calculate safeHarbour scores.

Related Skills

Explore More Software Engineering Skills→
djankiesdjankies

reviewing-dependencies

Detect unused, outdated, and vulnerable dependencies in npm projects.

Community
Advanced
bordenetbordenet
8

security-upgrade

Scan project dependencies for known vulnerabilities and upgrade affected packages.

Community
Advanced
AradotsoAradotso
11

npm-security-best-practices

Harden npm, pnpm, and Bun installs against supply-chain attacks.

Official
Advanced
DexploarerDexploarer
6

dependency-vulnerability-scanner

Scan dependency manifests and lockfiles for known vulnerabilities.

Community
Advanced