dependency-vulnerability-audit

Dependency Vulnerability Audit

Overview

This skill coordinates supply chain security assessment across three dimensions: vulnerability scanning (via real CLI tools), license compliance, and supply chain risk. It delegates CVE detection to actual vulnerability scanners that use live databases — LLM knowledge has a cutoff and cannot reliably detect recent CVEs.

Scanner-to-Ecosystem Mapping

Manifest	Ecosystem	Scanner	Install
package.json	Node.js	npm audit	Included with Node.js
requirements.txt, pyproject.toml, Pipfile	Python	pip-audit or safety	pip install pip-audit
go.mod	Go	govulncheck	go install golang.org/x/vuln/cmd/govulncheck@latest
Cargo.toml	Rust	cargo audit	cargo install cargo-audit
pom.xml	Java	mvn dependency:analyze	Apache Maven required
Gemfile	Ruby	bundle audit	gem install bundler-audit

Important: Non-zero exit codes from vulnerability scanners indicate findings, not errors. Treat scanner exit code != 0 as "vulnerabilities found," not "command failed."

The INCOMPLETE Verdict

When no scanner is available for the detected ecosystem, the verdict MUST be INCOMPLETE — not PASS. INCOMPLETE honestly represents that the vulnerability check could not be performed. License and supply chain analysis can still run, but CVE data will be missing.

---

CVE Vulnerability Scanning

Severity Categorization

• Critical: RCE, authentication bypass, data exfiltration — must fix before shipping
• High: Significant security impact — should fix soon
• Medium: Limited impact or requires unusual conditions — review and plan fix
• Low: Minimal impact — track but lower priority

For Each Finding, Identify

• Package name and affected version
• CVE/vulnerability ID (e.g., CVE-2024-XXXXX, GHSA-XXXXX)
• Severity (use scanner-reported severity)
• Whether a fixed version is available
• Whether the vulnerable package is a direct dependency or transitive