Identify and triage CVEs in project dependencies across multiple ecosystems.
npx skills add https://github.com/j4hr3n/dotfiles --skill sca-audit-j4hr3n
Please help me install this Agent Skill. Skill: sca-audit Source: https://github.com/j4hr3n/dotfiles/tree/main/configs/claude-code/skills/sca-audit Command: npx skills add https://github.com/j4hr3n/dotfiles --skill sca-audit-j4hr3n
Scan project dependencies for known CVEs to help teams identify risk before deployment and during dependency reviews.
Run the audit on your project to generate a vulnerability report for all dependency files.
High-intent search queries and answers about installing and using this skill.
Dependency vulnerability triage assesses reachability and exploitability of CVEs found in your project dependencies. It processes JSON reports from tools like osv-scanner or npm audit to help prioritize fixes before deployment.
Yes, it supports triaging Dependabot alerts and dependency reviews for Node.js and Python projects. It processes JSON vulnerability findings generated by osv-scanner or ecosystem-specific tools to evaluate exploitability and prioritize remediation.
You need osv-scanner or ecosystem-specific tools like npm audit, pip-audit, govulncheck, or trivy to produce a JSON-formatted findings report. The Skill uses this report to identify and triage CVEs across your project dependencies.
The best way to verify vulnerability status before release is running a dependency audit to generate a JSON findings report. This enables evidence-based triage of CVEs during pre-deployment checks and CI pipelines to identify risks early.
Yes, dependency vulnerability scanning works with Go, Rust, and .NET projects, alongside Node.js, Python, Java, Ruby, and PHP. You must run ecosystem-specific tools like govulncheck to generate the required JSON findings report for triage.
OWASPScan project manifests and lockfiles for known CVEs across multiple ecosystems.
mvillmowDetect security vulnerabilities in code and dependencies with static analysis.
ceratops-codeAutomate end-to-end GitHub dependency update workflows with automated checks and safe merges.
endorlabsAutomate dependency vulnerability remediation using Endor SCA findings and UIA evidence.
