security-audit

Audit SkiaSharp native dependencies for CVEs and generate a Security Audit Report.

5.5k|644|Updated Feb 22, 2016

Search Tags:#security #dependencies #audit #cve #skiasharp #mono

Ready to run

npx skills add https://github.com/mono/SkiaSharp --skill security-audit-mono

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/mono/SkiaSharp/tree/main/.github/skills/security-audit
Command: npx skills add https://github.com/mono/SkiaSharp --skill security-audit-mono

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Audits SkiaSharp's native dependencies security status and outputs a comprehensive report with actionable recommendations.

Core Features & Use Cases

Inventory and track security status of SkiaSharp's native dependencies.
Identify open CVEs, correlate issues and PRs, and verify fixes.
Generate a structured Security Audit Report for maintainers and stakeholders.

Quick Start

Run the security audit workflow to generate the initial status report.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit SkiaSharp native dependencies for security vulnerabilities?▼

The security audit process derives dependency versions from DEPS files, searches CVE databases, and validates fixes against commit history to output a formal Security Audit Report for SkiaSharp native dependencies.

What is dependency CVE tracking and how does it apply to SkiaSharp?▼

Dependency CVE tracking identifies open security vulnerabilities within native libraries. For SkiaSharp, it involves inventorying dependencies, correlating issues and PRs, and verifying applied fixes to generate a structured security status report.

Can I verify if a specific CVE fix has been applied to my native dependencies?▼

Yes, you can verify CVE fixes by validating remediation commits against repository history. The audit correlates open CVEs with issues and PRs to confirm whether necessary fixes have been successfully applied.

Does the security audit work for maintainers needing formal remediation planning?▼

Yes, the security audit is explicitly designed for maintainers and security teams. It provides CVE tracking, dependency verification, and actionable recommendations within a structured Security Audit Report to guide remediation planning.

How do I generate a Security Audit Report for SkiaSharp?▼

You generate a Security Audit Report by running the audit workflow, which automatically inventories native dependencies, searches for open CVEs, verifies fixes, and structures findings into a comprehensive report for stakeholders.

What are the limitations of auditing SkiaSharp native dependencies using DEPS?▼

Auditing SkiaSharp using DEPS is limited to deriving versions and validating fixes from commit history. It does not perform dynamic runtime analysis and relies entirely on correlating static repository data with known CVE databases.