agentsclimarketplace

Dependency check

Skill NovaCode37/claude-security-skills/skills/dependency-check

Production-ready Claude Code skills for cybersecurity — secret scanning, SAST, prompt-injection testing, HTTP/JWT/dependency auditing. Zero dependencies.

Install
npx -y skills add NovaCode37/claude-security-skills --skill dependency-check

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audit project dependencies for known-vulnerable versions and risky pinning. Parses requirements.txt and package.json, matches a bundled offline advisory DB, optionally queries OSV.dev live, and warns about unpinned versions. Use when the user asks to "check dependencies for vulnerabilities", "audit my requirements.txt / package.json", "scan for vulnerable packages", or "is my dependency tree secure".

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.3 KB, as published. Nobody here has run it

Dependency Check

Scans Python (requirements.txt) and npm (package.json) manifests for known-vulnerable versions and supply-chain risks. Offline by default — it ships a bundled advisory database so it runs in air-gapped CI — with an optional live OSV.dev lookup. Pure standard library.

When to use this skill

  • "Are any of my dependencies vulnerable?"
  • "Audit requirements.txt / package.json."
  • "Check for vulnerable / outdated packages before release."

What it reports

  • Known vulnerabilities — version matches against the bundled advisory DB (or OSV.dev with --online), with CVE/ID, severity and summary.
  • Unpinned dependencies — ranges (^, ~, >=) or missing pins that make builds non-reproducible and widen supply-chain exposure.

How to run it

# Offline scan (bundled advisory DB)
python skills/dependency-check/checker.py requirements.txt
python skills/dependency-check/checker.py package.json

# Scan a directory (auto-discovers both manifest types)
python skills/dependency-check/checker.py .

# Live advisory lookup via OSV.dev
python skills/dependency-check/checker.py requirements.txt --online

# JSON output
python skills/dependency-check/checker.py . --json

Exit codes: 0 no known vulns · 1 vulnerabilities found · 2 no manifest / usage error.

Recommended workflow for Claude

  1. Run offline first for a fast baseline, then --online for full coverage if the user has network access.
  2. For each vulnerable package, recommend the minimum fixed version and note breaking-change risk.
  3. Encourage exact pins (== / lockfiles) for reproducible, auditable builds.

Note

The bundled DB is intentionally small (well-known historical CVEs) so the tool is self-contained and testable. For comprehensive coverage use --online (OSV.dev) or integrate a dedicated scanner; treat the offline DB as a fast first pass.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.