agentsclimarketplace

Dependency vulnerability audit

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-gemini-3.1-flash-lite-preview/dependency-vulnerability-check/dependency-vulnerability-audit

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install
npx -y skills add cxcscmu/SkillLearnBench --skill dependency-vulnerability-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

How to perform security audits on package-lock.json. Use this skill whenever you need to identify HIGH or CRITICAL vulnerabilities in project dependencies.

SKILL.md

1.1 KB, 212 tokens by cl100k_base, as published. Nobody here has run it

Dependency Vulnerability Audit

This skill outlines the process for auditing package-lock.json for security vulnerabilities.

Audit Workflow

  1. Scan: Use trivy in offline mode to scan package-lock.json.
    • Ensure the Trivy DB is present at /root/.cache/trivy/db/trivy.db.
    • Execute: trivy fs --db-repository /root/.cache/trivy/db --offline-scan --format json package-lock.json > scan_results.json
  2. Filter: Parse the scan_results.json to filter for vulnerabilities with Severity of HIGH or CRITICAL.
  3. Data Extraction: Extract the following fields:
    • Package Name
    • Installed Version
    • CVE ID
    • Severity Level
    • CVSS Score
    • Fixed Version (if available)
    • Title
    • Reference URL
  4. Validation: Verify the extracted information against NVD/GHSA if necessary using cvss-score-extraction skill.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.