skills.rest
hardw00t
hardw00tCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sca-security

Scan dependencies for CVEs and audit licenses across software projects.

90|14|Updated Jan 12, 2026
Search Tags:#CI/CD#dependencies#license#vulnerabilities#supply-chain#analyze#SBOM
One-click install
npx skills add https://github.com/hardw00t/ai-security-arsenal --skill sca-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sca-security
Source: https://github.com/hardw00t/ai-security-arsenal/tree/main/skills/sca-security
Command: npx skills add https://github.com/hardw00t/ai-security-arsenal --skill sca-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill enables teams to rapidly identify vulnerable dependencies, verify license compliance, and assess supply-chain risks across software projects.

Core Features & Use Cases

  • Dependency scanning across npm, pip, Maven, and Go modules to surface known CVEs and license issues.
  • SBOM generation (CycloneDX/SPDX) for visibility into transitive dependencies and supply-chain risk.
  • License compliance checks and policy enforcement across ecosystems.
  • CI/CD integration to automate security checks during builds and releases.
  • Guidance and remediation workflows based on SBOM and vulnerability findings; references located in references/vulnerability_databases.md, references/license_guide.md.

Quick Start

  • Install required tools: Trivy, Grype, Syft, OWASP Dependency-Check, and Snyk CLI as documented in prerequisites.
  • Generate an SBOM for your project: python3 scripts/sbom_generate.py /path/to/project
  • Run multi-ecosystem vulnerability scans: bash scripts/scan_all.sh /path/to/project
  • Check licenses: python3 scripts/license_check.py /path/to/project

Frequently Asked Questions about sca-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan dependencies for known vulnerabilities across multiple language ecosystems?▼

To scan dependencies for vulnerabilities across npm, pip, Maven, and Go modules, you can run the multi-ecosystem scanning script. It utilizes external tools like Trivy, Grype, and OWASP Dependency-Check to surface known CVEs in both direct and transitive dependencies.

What is the best way to generate an SBOM for supply-chain risk visibility?▼

Generating an SBOM for supply-chain risk visibility involves creating a CycloneDX or SPDX document of your project's dependencies. You can use the provided script with Syft to produce an SBOM that maps transitive dependencies and highlights potential risks.

Can I integrate dependency vulnerability scanning and license checks into CI/CD workflows?▼

Yes, you can integrate dependency vulnerability scanning and license checks into CI/CD workflows. This automation enforces security policies and assesses supply-chain risks automatically during builds and releases.

Do I need to install external tools like Trivy and Grype before scanning dependencies?▼

Yes, you need to install external tools such as Trivy, Grype, Syft, and OWASP Dependency-Check before scanning dependencies. These tools are required to perform vulnerability scanning, SBOM generation, and license analysis.

What guidance is available for remediating vulnerabilities found in an SBOM?▼

Guidance for remediating vulnerabilities found in an SBOM is provided through dedicated reference documents. These references offer workflows and remediation steps based on findings from vulnerability databases and license guides.

Related Skills

Explore More Software Engineering Skills→
devkenidevkeni
1

sca-security

Scan software dependencies for vulnerabilities and license compliance issues.

Community
Advanced
heaptracetechnologyheaptracetechnology
13

dep-vuln

Scan dependencies across npm, pip, Go, Ruby, and Java for vulnerabilities and generate SBOMs.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

phase-2-automation-weeks-5-8

Automate CI/CD gate enforcement, SBOM generation, vulnerability scanning, and SLSA provenance.

Official
Advanced
mitchellvandusen-cellmitchellvandusen-cell

dependency-audit

Audit Python dependencies for CVEs, outdated packages, licenses, and unused imports.

Community
Advanced