What problem does it solve?
Manually tracking and fixing dependency vulnerabilities across multiple programming ecosystems is time-consuming, error-prone, and often leads to vulnerable code being shipped to production. This Skill automates the entire dependency security workflow, from detection to gating, to eliminate that risk.
Core Features & Use Cases
- Cross-ecosystem vulnerability scanning: Automatically detects vulnerable dependencies in JavaScript/TypeScript, Python, Rust, Go, and C#/.NET projects using osv-scanner or native per-ecosystem audit tools.
- Safe auto-remediation: Automatically applies non-breaking patch and minor version bumps to fix vulnerabilities, with mandatory build verification to ensure no regressions.
- Commit gating: Blocks commits that contain unpatched high or critical severity vulnerabilities, or breaking upgrades that require engineering design work.
- Breaking upgrade routing: Automatically routes major version upgrades to the appropriate language-specific engineering skill for designed implementation, paired with architect review for wide blast radius changes.
- Use Case: A team with a polyglot codebase can use this Skill to automatically scan all dependency manifests before every commit, fix low-risk vulnerabilities on the fly, route major framework upgrades to the right engineers, and ensure no high-severity supply-chain issues make it to production.
Quick Start
Use the vulnerability-manager skill to scan your project's dependencies for known vulnerabilities, auto-apply safe version fixes, and return a PASS or BLOCK verdict for your commit.
