Run3 dependency vulnerability scanner

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill run3_dependency_vulnerability_scanner

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Analyze /root/package-lock.json to identify HIGH and CRITICAL vulnerabilities using automated security audit tools and database lookups.

1.3 KB, 271 tokens by cl100k_base, as published. Nobody here has run it

Execute npm audit --json or audit-ci on /root/package-lock.json to generate a report of dependency vulnerabilities.
Filter the raw output to retain only vulnerabilities with severity set to high or critical.
For each identified vulnerability, extract the following:
- Package: The name of the vulnerable package.
- Version: The installed version found in the dependency tree.
- CVE ID: The CVE identifier associated with the vulnerability.
- Severity: The level (High or Critical).
- CVSS Score: Retrieve the score by prioritizing sources in the order: NVD -> GHSA -> RedHat. Parse the nested cvss object specifically looking for cvssV3.baseScore or cvssV3.score. If unavailable, search for cvssV2.score.
- Fixed Version: The first version where the patch is applied; if no patch is available, record as "N/A".
- Title/Description: A summary of the vulnerability.
- Url: The reference link provided by the audit source.
Format the extracted data into a CSV structure exactly matching: Package,Version,CVE_ID,Severity,CVSS_Score,Fixed_Version,Title,Url.