dependency-scanner_skill

Overview

This skill scans project dependencies for known security vulnerabilities, generates structured reports, and recommends remediation steps. It supports common ecosystems (npm, yarn, pip, bundler, go, cargo) and integrates suggestions for CI/CD automation and continuous monitoring. The output includes severity categorization, fix commands, and prioritization guidance.

How this skill works

The scanner detects the project's package manager, runs the appropriate audit tool (npm audit, pip-audit, bundler-audit, Snyk, or OWASP Dependency-Check), and collects results as JSON or human-readable reports. It parses vulnerabilities by severity, identifies available fixes or version upgrades, and produces a prioritized remediation report with recommended commands and timelines. Optional CI/CD and Dependabot/renovate configuration snippets are provided for automation.

When to use it

• You want a quick security audit of project dependencies (check vulnerabilities).
• Preparing a release and need a dependency security report for compliance.
• Investigating specific CVEs or suspicious packages in the dependency tree.
• Setting up automated dependency scanning in CI/CD or scheduling weekly audits.
• Triaging vulnerability findings and planning remediation work.

Best practices

• Run audits regularly (weekly minimum) and include them in CI pipelines.
• Prioritize fixes by severity and exploitability; fix critical issues immediately.
• Test dependency upgrades in staging before deploying to production.
• Use automated tooling (Dependabot, Renovate, Snyk) for continuous updates.
• Document accepted risks and track exceptions with justification and review dates.

Example use cases

• Run npm audit --json and generate a report listing critical/high vulnerabilities with npm install commands for fixes.
• Use pip-audit --format json on a requirements.txt file and produce a remediation checklist for Python deps.
• Add a GitHub Actions job to run npm audit weekly, upload reports, and fail the build on high severity.
• Run OWASP Dependency-Check for multi-language projects and produce an HTML report for security reviews.
• Configure Dependabot/renovate to open PRs for dependency updates and reduce manual patching.