x-osv

Name: x-osv
Availability: InStock
Author: x-cmd

Query OSV database for package vulnerabilities and scan local projects.

4.6k|161|Updated Oct 1, 2022

Search Tags:#security #dependency management #vulnerability scanning #osv-scanner #osv

Ready to run

npx skills add https://github.com/x-cmd/x-cmd --skill x-osv

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: x-osv
Source: https://github.com/x-cmd/x-cmd/tree/main/mod/osv
Command: npx skills add https://github.com/x-cmd/x-cmd --skill x-osv

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires x-cmd, osv-scanner, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps in identifying vulnerabilities in packages and scanning local projects for vulnerable dependencies.

Core Features & Use Cases

Vulnerability Query: Query the OSV database for package vulnerabilities.
Project Scanning: Scan local projects for vulnerabilities using osv-scanner.
SARIF Reports: Generate SARIF security reports.
Multi-ecosystem Support: Supports various ecosystems such as npm, pip, Maven, Go, Rust, etc.

Quick Start

To query vulnerabilities for a package, use the command:

x osv q -p jq -v 1.7.1

To scan a local project for vulnerabilities, use the command:

x osv scanner .

Frequently Asked Questions about x-osv

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a local project for vulnerable dependencies?▼

You can scan a local project for vulnerable dependencies by running `x osv scanner .` in your project directory to identify security issues using osv-scanner.

Can I query the OSV database for a specific package version vulnerability?▼

Yes, you can query the OSV database for a specific package vulnerability by running a command like `x osv q -p jq -v 1.7.1` to check that exact version.

Does this vulnerability scanner support multiple ecosystems like npm and pip?▼

Yes, this vulnerability scanner supports multiple ecosystems including npm, pip, Maven, Go, and Rust, allowing you to scan diverse project dependencies for security issues.

How do I generate SARIF security reports for scanned project dependencies?▼

You can generate SARIF security reports by scanning your local project for vulnerabilities, which outputs results in various formats including the standard SARIF report structure.

Do I need to install x-cmd and osv-scanner to query package vulnerabilities?▼

Yes, you need both x-cmd and osv-scanner installed as dependencies, because the Skill automates the querying process by running these underlying tools to fetch vulnerability data.