agentsclimarketplace
Sign in

Dependency vulnerability audit

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-gemini-3.1-flash-lite-preview/dependency-vulnerability-check/dependency-vulnerability-audit

How to perform security audits on package-lock.json. Use this skill whenever you need to identify HIGH or CRITICAL vulnerabilities in project dependencies.From its SKILL.md

Install
npx -y skills add cxcscmu/SkillLearnBench --skill dependency-vulnerability-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.1 KB, 212 tokens by cl100k_base, as published. Nobody here has run it

Dependency Vulnerability Audit

This skill outlines the process for auditing package-lock.json for security vulnerabilities.

Audit Workflow

  1. Scan: Use trivy in offline mode to scan package-lock.json.
    • Ensure the Trivy DB is present at /root/.cache/trivy/db/trivy.db.
    • Execute: trivy fs --db-repository /root/.cache/trivy/db --offline-scan --format json package-lock.json > scan_results.json
  2. Filter: Parse the scan_results.json to filter for vulnerabilities with Severity of HIGH or CRITICAL.
  3. Data Extraction: Extract the following fields:
    • Package Name
    • Installed Version
    • CVE ID
    • Severity Level
    • CVSS Score
    • Fixed Version (if available)
    • Title
    • Reference URL
  4. Validation: Verify the extracted information against NVD/GHSA if necessary using cvss-score-extraction skill.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.