Scan project manifests and lockfiles for known CVEs across multiple ecosystems.
npx skills add https://github.com/OWASP/secure-agent-playbook --skill sca-audit-owasp
Please help me install this Agent Skill. Skill: sca-audit Source: https://github.com/OWASP/secure-agent-playbook/tree/main/skills/sca-audit Command: npx skills add https://github.com/OWASP/secure-agent-playbook --skill sca-audit-owasp
Automates the identification and triage of known CVEs across a project's dependencies, reducing risk and helping teams prioritize remediation.
Run a full dependency CVE scan against your project to surface vulnerabilities.
High-intent search queries and answers about installing and using this skill.
To scan dependencies for CVEs, apply this tool to manifests like package.json, requirements.txt, go.mod, pom.xml, Gemfile, and Cargo.toml to run appropriate scanners and collect vulnerability data.
The best way to triage open-source vulnerabilities is to scan lockfiles and manifests to assess exploitability, exposure, and patch availability, which produces actionable remediation steps for deployment.
Yes, you can use npm audit and pip-audit to scan lockfiles. The tool specifies required scanners including osv-scanner, pip-audit, govulncheck, npm audit, and trivy to collect CVE data across ecosystems.
Dependency vulnerability triage assesses exploitability and fix availability by running scanners on manifests and lockfiles to evaluate reachability, exposure, and patch status, producing actionable remediation steps.
Yes, dependency scanning works with both manifests and lockfiles. It locates files like package.json, requirements.txt, go.mod, pom.xml, Gemfile, Cargo.toml, and lockfiles to ensure comprehensive CVE coverage.
To identify CVEs in project dependencies, you need scanning tools such as osv-scanner, npm audit, pip-audit, govulncheck, and trivy, which the tool specifies to collect vulnerability data.
Q16GScan project manifests and lockfiles to identify known CVEs.
rajveersingh11Identifies outdated packages and CVEs in software dependencies for risk management.
j4hr3nIdentify and triage CVEs in project dependencies across multiple ecosystems.
devendrapratapsinghScan application code for vulnerabilities and hardcoded secrets.
