Dependency Scan
Analyze package dependencies for known vulnerabilities.
Quick Start
/dependency-scan # Scan all detected package managers /dependency-scan --npm # Node.js packages only /dependency-scan --pip # Python packages only /dependency-scan --fix # Auto-fix where possible
What This Skill Does
-
Identifies package managers in your project
-
Parses dependency manifests (package.json, requirements.txt, etc.)
-
Checks vulnerability databases for known CVEs
-
Reports severity and remediation options
-
Optionally auto-fixes by updating to patched versions
Supported Package Managers
Ecosystem Files Tool Used
Node.js package.json, package-lock.json npm audit
Python requirements.txt, Pipfile, pyproject.toml pip-audit, safety
Ruby Gemfile, Gemfile.lock bundler-audit
Java pom.xml, build.gradle dependency-check
Go go.mod, go.sum govulncheck
Rust Cargo.toml, Cargo.lock cargo-audit
PHP composer.json, composer.lock composer audit
.NET *.csproj, packages.config dotnet list --vulnerable
Scan Modes
Full Scan
/dependency-scan
Scans all detected package managers, reports all severity levels.
Specific Ecosystem
/dependency-scan --npm /dependency-scan --pip /dependency-scan --go
Severity Filter
/dependency-scan --severity critical,high /dependency-scan --severity medium
Auto-Fix Mode
/dependency-scan --fix /dependency-scan --fix --dry-run # Preview changes
Attempts to update vulnerable packages to patched versions.
Output Format
Summary View
DEPENDENCY SCAN RESULTS
Scanned: package.json, requirements.txt Packages analyzed: 127 (78 npm, 49 pip)
VULNERABILITIES BY SEVERITY Critical: 2 High: 4 Medium: 8 Low: 12
TOP ISSUES
[!] CRITICAL: lodash < 4.17.21 CVE-2021-23337: Command Injection Affected: lodash@4.17.19 Fix: npm update lodash
[!] CRITICAL: urllib3 < 2.0.6 CVE-2023-43804: Cookie Leak Affected: urllib3@1.26.0 Fix: pip install urllib3>=2.0.6
[H] HIGH: express < 4.19.2 CVE-2024-29041: Open Redirect Affected: express@4.18.0 Fix: npm update express
Detailed View
/dependency-scan --details
DETAILED VULNERABILITY REPORT
CVE-2021-23337
Package: lodash Installed: 4.17.19 Patched: 4.17.21 Severity: CRITICAL (CVSS 9.8)
Description: Command Injection in lodash template function allows arbitrary command execution via crafted template strings.
Attack Vector: Remote, no auth required Exploitability: Public exploit available
References:
Remediation: npm update lodash
or
npm install lodash@4.17.21
Vulnerability Sources
Databases Consulted
Database Coverage
NVD (National Vulnerability Database) All CVEs
GitHub Advisory Database GitHub-reported
OSV (Open Source Vulnerabilities) Multi-ecosystem
npm Security Advisories Node.js specific
PyPI Advisory Database Python specific
RustSec Advisory Database Rust specific
CVSS Scoring
Score Severity
9.0-10.0 Critical
7.0-8.9 High
4.0-6.9 Medium
0.1-3.9 Low
Commands Used
Node.js (npm)
npm audit --json npm audit fix # Auto-fix npm audit fix --force # Breaking changes OK
Python (pip-audit)
pip-audit pip-audit --fix pip-audit -r requirements.txt
Python (safety)
safety check safety check -r requirements.txt
Ruby (bundler-audit)
bundle-audit check bundle-audit update # Update advisory DB
Go (govulncheck)
govulncheck ./...
Rust (cargo-audit)
cargo audit cargo audit fix # Auto-fix
Auto-Fix Behavior
Safe Fixes
Updates within semver-compatible range:
-
Patch versions (1.2.3 → 1.2.4)
-
Minor versions if locked to major (^1.2.3 → ^1.3.0)
Breaking Fixes
May introduce breaking changes:
-
Major version updates
-
Requires --force flag
Fix Report
AUTO-FIX REPORT
Fixed: 8 vulnerabilities lodash: 4.17.19 → 4.17.21 axios: 0.21.0 → 0.21.1 minimist: 1.2.5 → 1.2.6
Unable to fix: 2 vulnerabilities react-scripts: No patch available (major version required) webpack-dev-server: Conflicts with other dependencies
Review package.json changes before committing.
Configuration
Ignore Known Issues
Create .dependency-scan-ignore :
Ignore specific CVEs (document reason!)
ignore:
-
id: CVE-2021-23337 reason: "Not exploitable in our usage, lodash template not used" expires: 2024-12-31
-
id: GHSA-xxx-xxx reason: "Development dependency only"
Ignore packages
packages:
- name: lodash versions: ["< 4.17.0"] # Only old versions
Severity Thresholds
.dependency-scan.yaml
thresholds: fail_on: critical # Fail CI on critical warn_on: high # Warn on high ignore_below: low # Don't report low
fix: auto_fix: true allow_major: false # No major version bumps
CI/CD Integration
GitHub Actions
-
name: Dependency Scan run: | /dependency-scan --severity critical,high --fail-on-findings
-
name: Auto-fix and PR if: failure() run: | /dependency-scan --fix git add . gh pr create --title "Security: Update vulnerable dependencies"
Pre-Commit
#!/bin/sh
Run on package.json changes
if git diff --cached --name-only | grep -q "package.json|requirements.txt"; then /dependency-scan --severity critical,high fi
Dependency Health
Beyond CVEs
/dependency-scan --health
Additional checks:
-
Outdated packages: Major versions behind
-
Deprecated packages: No longer maintained
-
License issues: Incompatible licenses
-
Maintenance: Last update, open issues
Health Report
DEPENDENCY HEALTH
Outdated (major behind): 5 react: 17.0.2 → 18.2.0 typescript: 4.9.5 → 5.3.3
Deprecated: 1 request: Use got, axios, or node-fetch
Unmaintained (>2 years): 2 moment: Consider dayjs or date-fns
License Issues: 0
Related Skills
-
/security-scan
-
Full security analysis
-
/secrets-scan
-
Credential detection
-
/config-scan
-
Configuration security