Dependency vulnerability audit
[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.
npx -y skills add cxcscmu/SkillLearnBench --skill dependency-vulnerability-auditAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
How to perform security audits on package-lock.json. Use this skill whenever you need to identify HIGH or CRITICAL vulnerabilities in project dependencies.
SKILL.md
1.1 KB, 212 tokens by cl100k_base, as published. Nobody here has run it
Dependency Vulnerability Audit
This skill outlines the process for auditing package-lock.json for security vulnerabilities.
Audit Workflow
- Scan: Use
trivyin offline mode to scanpackage-lock.json.- Ensure the Trivy DB is present at
/root/.cache/trivy/db/trivy.db. - Execute:
trivy fs --db-repository /root/.cache/trivy/db --offline-scan --format json package-lock.json > scan_results.json
- Ensure the Trivy DB is present at
- Filter: Parse the
scan_results.jsonto filter for vulnerabilities withSeverityofHIGHorCRITICAL. - Data Extraction: Extract the following fields:
- Package Name
- Installed Version
- CVE ID
- Severity Level
- CVSS Score
- Fixed Version (if available)
- Title
- Reference URL
- Validation: Verify the extracted information against NVD/GHSA if necessary using
cvss-score-extractionskill.