vuln-dependency

To scan project dependencies for known CVEs, the skill parses manifest files like package.json, requirements.txt, and pom.xml to perform security audits and risk assessment across Node.js, Python, and Java ecosystems. It identifies direct and transitive dependency vulnerabilities.

Dependency confusion is a supply chain risk where packages are pulled from unauthorized registries. The skill detects dependency confusion by validating registry configurations and namespace scoping during the manifest discovery and audit check processes.

Yes, you can audit vulnerable dependencies in Node.js and Java projects. The skill is applicable to projects across multiple ecosystems with manifest files, parsing the dependency tree to report known CVEs and outdated packages.

To generate an audit trail for security vulnerabilities, the skill appends findings to ./assessment/vulnerabilities.md. This centralizes vulnerability reporting and risk assessment results for remediation planning and bug bounty programs.

Yes, dependency vulnerability scanning works with transitive dependencies. The skill performs dependency tree parsing to identify and report known CVEs and supply chain risks hidden deep within the project dependency graph.

The best way to find outdated packages and supply chain risks is running an automated dependency scan. The skill identifies outdated packages, validates registry configurations, and reports exploitable weaknesses before they are weaponized.