Run2 npm vulnerability scanning enhanced

Skill cxcscmu/SkillLearnBench/skills/b2-self-feedback-claude-haiku-4-5/dependency-vulnerability-check/run2_npm-vulnerability-scanning-enhanced

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill run2_npm-vulnerability-scanning-enhanced

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Enhanced npm vulnerability scanning with Trivy supporting multiple severity levels and complete metadata extraction

SKILL.md

4.6 KB, ~1.2k tokens by cl100k_base, as published. Nobody here has run it

Enhanced npm Dependency Vulnerability Scanning

Purpose

Scan npm package-lock.json files for vulnerabilities using Trivy with complete metadata extraction, including severity sources, vendor data, and multiple reference URLs.

Key Improvements Over V1

Multiple Severity Sources: Track severity from different vendors (GHSA, NVD, RedHat)
Vendor-specific Scoring: Extract vendor severity codes for better analysis
Multiple References: Capture all reference URLs, not just primary
Data Enrichment: Include DataSource information for audit trail
Timestamp Tracking: Record publication and modification dates

Installation & Setup

Prerequisites

Trivy 0.40.0+ installed
npm package-lock.json file
Access to offline vulnerability database

Setup

# Install Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# Verify installation
trivy --version

Scan Configuration

Command with Enhanced Metadata

trivy fs /root/package-lock.json \
  --format json \
  --output vulnerabilities.json \
  --scanners vuln \
  --skip-db-update \
  --severity HIGH,CRITICAL

JSON Output Structure

Enhanced Trivy output includes:

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Type": "npm",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2022-25883",
          "PkgName": "semver",
          "InstalledVersion": "7.3.7",
          "FixedVersion": "7.5.2, 6.3.1, 5.7.2",
          "Severity": "HIGH",
          "SeveritySource": "ghsa",
          "VendorSeverity": {
            "ghsa": 3,
            "nvd": 7
          },
          "Title": "nodejs-semver: Regular expression denial of service",
          "Description": "...",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-25883",
          "References": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-25883",
            "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"
          ],
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory npm"
          },
          "PublishedDate": "2022-11-16T14:15:00Z",
          "LastModifiedDate": "2023-09-01T10:00:00Z"
        }
      ]
    }
  ]
}

Data Extraction Fields

For each vulnerability record:

Field	Source	Notes
`VulnerabilityID`	Direct	Primary CVE ID (handle comma-separated)
`PkgName`	Direct	Package name (may include scope)
`InstalledVersion`	Direct	Exact installed version
`FixedVersion`	Direct	First fixed version (may have multiple)
`Severity`	`Severity` field	HIGH or CRITICAL only
`SeveritySource`	Track source	ghsa, nvd, or other
`Title`	Direct	Vulnerability title
`PrimaryURL`	Direct	Primary reference URL
References	Direct	All reference URLs

Severity Filtering

Valid Severities for This Audit

HIGH
CRITICAL

Severity Source Priority

GHSA (GitHub) - Most recent data
NVD (NIST) - Most authoritative
RedHat - Vendor-specific
Ubuntu - Ubuntu-specific
Other sources - Use if available

Vendor Severity Codes

GHSA uses numeric severity codes:

0 = LOW
1 = MODERATE
2 = MEDIUM
3 = HIGH
4 = CRITICAL

NVD uses numeric CVSS scores (0.0-10.0)

Handling Edge Cases

Multiple CVE IDs

Some vulnerabilities may report multiple CVE IDs separated by commas:

"CVE-2023-XXXXX, CVE-2023-YYYYY"

Split and process each separately while maintaining package/version context.

Multiple Fixed Versions

When multiple branches are maintained:

"FixedVersion": "7.5.2, 6.3.1, 5.7.2"

Extract the first fixed version for the matched major version if possible.

Incomplete FixedVersion Data

Some vulnerabilities may not have fixes:

"FixedVersion": ""

Use "N/A" in reports.

Reference URL Priority

PrimaryURL: Use as primary reference
References array: Include if primary is missing
Construct NVD URL if needed: https://nvd.nist.gov/vuln/detail/{CVE-ID}

Audit Trail Elements

Track for audit purposes:

DataSource.ID: Which database provided the vulnerability info
DataSource.Name: Human-readable database name
PublishedDate: When the CVE was published
LastModifiedDate: When the record was last updated

This enables tracking which vulnerabilities came from which sources and how current the data is.