shine-dep-audit

Name: shine-dep-audit
Availability: InStock
Author: diShine

Detect known dependency vulnerabilities across multiple ecosystems and report CVE details with upgrade guidance.

1|Updated Apr 15, 2026

Search Tags:#automation #security #dependencies #audit #vulnerabilities #cve #package-management

Ready to run

npx skills add https://github.com/diShine-digital-agency/SHINE-Code-System --skill shine-dep-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: shine-dep-audit
Source: https://github.com/diShine-digital-agency/SHINE-Code-System/tree/main/skills/shine-dep-audit
Command: npx skills add https://github.com/diShine-digital-agency/SHINE-Code-System --skill shine-dep-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit teams and CI pipelines often miss or delay fixing vulnerable dependencies across multiple ecosystems; this Skill automatically identifies and reports known CVEs and surfaces actionable fixes.

Core Features & Use Cases

Multi-ecosystem vulnerability auditing: detects CVEs across npm, Python, Go, Java, Ruby, Rust, and more by scanning common manifest files.
Automated auditing workflow: uses OSV MCP when connected and falls back to npm audit, pip audit, or govulncheck to cover all packages.
Actionable reporting: returns per-vulnerability details (CVE ID, severity, affected package, current version, fixed version) and upgrade guidance.
Prioritized remediation: sorts findings by severity and emphasizes critical items for fast triage.
Use Case: Integrate into CI to automatically flag vulnerable dependencies before merges.

Quick Start

Scan your project directory for dependency manifests and generate a vulnerability report.

Frequently Asked Questions about shine-dep-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit dependencies for known CVEs across multiple ecosystems?▼

To audit dependencies for known CVEs, this Skill scans common manifest files like package.json, requirements.txt, go.mod, and Cargo.lock. It uses OSV MCP or falls back to npm audit, pip audit, and govulncheck to report vulnerabilities and recommended upgrades.

What is dependency vulnerability auditing and how does it prioritize remediation?▼

Dependency vulnerability auditing identifies known CVEs in project packages and prioritizes remediation by severity. It returns per-item details including CVE ID, affected package, current version, and fixed version, emphasizing critical items for fast triage.

Can I use this audit tool with Python, Go, and Rust projects?▼

Yes, you can audit Python, Go, and Rust projects by scanning requirements.txt, Pipfile.lock, go.mod, go.sum, and Cargo.lock. The tool detects vulnerabilities across these ecosystems using OSV MCP, pip audit, or govulncheck fallbacks.

Does dependency auditing work without an OSV MCP connection?▼

Dependency auditing works without an OSV MCP connection by falling back to standard ecosystem tools like npm audit, pip audit, or govulncheck. This ensures multi-ecosystem vulnerability scanning and actionable reporting remain functional offline.

What's the best way to integrate vulnerability scanning into a CI pipeline?▼

The best way to integrate vulnerability scanning into CI pipelines is scanning project directories for dependency manifests before merges. This automatically flags vulnerable dependencies, outputs per-vulnerability details, and provides upgrade guidance to prevent delayed fixes.