sca-runner

Dependency scanning detects security vulnerabilities in your project's libraries. Run `npx sca-runner .` in your project folder to scan dependencies using npm audit or Trivy, which auto-detects based on your project type and outputs a structured JSON report with findings and severity levels.

Yes, npm audit covers Node.js projects, but multi-language scanning requires Trivy, which supports Python, Go, Java, and other ecosystems. The Skill auto-selects the appropriate scanner or lets you specify npm audit explicitly for Node.js-only projects.

A vulnerability scan output includes the tool used, scan path, scan date, discovered vulnerabilities with severity levels, CVSS scores, CWE identifiers when available, and a summary of findings. The unified JSON format makes results easy to integrate into CI/CD pipelines.

Yes, the Skill outputs structured JSON and standard exit codes suitable for automation. Run it in your deployment pipeline to detect vulnerable dependencies before release and fail builds when security issues exceed your risk threshold.

npm audit detects vulnerabilities in Node.js packages, while Trivy scans multi-language projects including Python, Go, and container images. The Skill prefers Trivy when available for broader ecosystem coverage, but falls back to npm audit for Node.js-only analysis.