shine-dep-audit

To audit dependencies for known CVEs, this Skill scans common manifest files like package.json, requirements.txt, go.mod, and Cargo.lock. It uses OSV MCP or falls back to npm audit, pip audit, and govulncheck to report vulnerabilities and recommended upgrades.

Dependency vulnerability auditing identifies known CVEs in project packages and prioritizes remediation by severity. It returns per-item details including CVE ID, affected package, current version, and fixed version, emphasizing critical items for fast triage.

Yes, you can audit Python, Go, and Rust projects by scanning requirements.txt, Pipfile.lock, go.mod, go.sum, and Cargo.lock. The tool detects vulnerabilities across these ecosystems using OSV MCP, pip audit, or govulncheck fallbacks.

Dependency auditing works without an OSV MCP connection by falling back to standard ecosystem tools like npm audit, pip audit, or govulncheck. This ensures multi-ecosystem vulnerability scanning and actionable reporting remain functional offline.

The best way to integrate vulnerability scanning into CI pipelines is scanning project directories for dependency manifests before merges. This automatically flags vulnerable dependencies, outputs per-vulnerability details, and provides upgrade guidance to prevent delayed fixes.