cve-scan

Name: cve-scan
Author: softspark

161stars21forks

How to install cve-scan?

softspark/ai-toolkit/cve-scan

$npx -y skills add softspark/ai-toolkit --skill cve-scan

Installs into the current project.

Summary

Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart). Triggers: CVE scan, vulnerability scan, npm audit, pip audit.

Files · 1

View on GitHub

SKILL.md

1	# /cve-scan - Dependency CVE Scanner
2
3	$ARGUMENTS
4
5	Detect project ecosystems and scan dependencies for known vulnerabilities using native audit tools. Zero external dependencies — uses tools already installed in the project environment.
6
7	## Usage
8
9	```
10	/cve-scan # Auto-detect all ecosystems, scan all
11	/cve-scan --ecosystem npm # Force specific ecosystem
12	/cve-scan --fix # Auto-fix where possible (npm audit fix, etc.)
13	/cve-scan --json # Machine-readable JSON output
14	```
15
16	## What This Command Does
17
18	1. Detect package managers by lock/manifest files in the project
19	2. Run the native audit command for each detected ecosystem
20	3. Parse results into a unified severity-based report
21	4. Report CVE IDs, affected packages, installed vs fixed versions, advisory links
22	5. Fix automatically when `--fix` is passed (where the tool supports it)
23
24	## Ecosystem Detection & Commands
25
26	\| Manifest File \| Lock File \| Ecosystem \| Audit Command \| CVE Database \|
27	\|---------------\|-----------\|-----------\|---------------\|--------------\|
28	\| `package.json` \| `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` \| npm/yarn/pnpm \| `npm audit --json` / `yarn audit --json` / `pnpm audit --json` \| GitHub Advisory DB \|
29	\| `requirements.txt` / `pyproject.toml` / `setup.py` \| `requirements.txt` \| pip \| `pip-audit --format=json` \| OSV / PyPI Advisory \|
30	\| `composer.json` \| `composer.lock` \| composer \| `composer audit --format=json` \| Packagist / FriendsOfPHP \|
31	\| `Cargo.toml` \| `Cargo.lock` \| cargo \| `cargo audit --json` \| RustSec Advisory DB \|
32	\| `go.mod` \| `go.sum` \| go \| `govulncheck ./...` \| Go Vulnerability DB \|
33	\| `Gemfile` \| `Gemfile.lock` \| bundler \| `bundle-audit check` \| Ruby Advisory DB \|
34	\| `pubspec.yaml` \| `pubspec.lock` \| dart/flutter \| `dart pub outdated --json` \| pub.dev \|
35
36	## Steps
37
38	1. Detect ecosystems: Glob for manifest/lock files at project root and common subdirectories
39	2. Check tool availability: Verify audit tool is installed for each detected ecosystem
40	3. Run audit: Execute native audit command, capture JSON output where available
41	4. Parse results: Extract CVE ID, package name, installed version, fixed version, severity, advisory URL
42	5. Unified report: Merge all ecosystems into single report sorted by severity
43	6. Fix mode: If `--fix` passed, run `npm audit fix`, `pip-audit --fix`, `cargo audit fix` etc.
44	7. Exit code: Non-zero if any CRITICAL or HIGH vulnerabilities found
45
46	## Detection Script
47
48	Run the bundled detection script to quickly identify ecosystems and tool availability:
49
50	```bash
51	python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py
52	```
53
54	Options:
55	```bash
56	python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --json # JSON output
57	python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --fix # Auto-fix mode
58	python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --ecosystem npm # Specific ecosystem
59	```
60
61	## Output Format
62
63	```markdown
64	## CVE Scan Report
65
66	### Ecosystems Detected
67	- npm (package-lock.json) — `npm audit` available ✓
68	- pip (requirements.txt) — `pip-audit` not installed ⚠️
69
70	### Summary
71	\| Severity \| Count \|
72	\|----------\|-------\|
73	\| CRITICAL \| 1 \|
74	\| HIGH \| 3 \|
75	\| MEDIUM \| 5 \|
76	\| LOW \| 2 \|
77
78	### Findings
79
80	#### [CRITICAL] lodash@4.17.20 (npm)
81	- CVE: CVE-2021-23337
82	- Title: Prototype Pollution
83	- Fixed in: 4.17.21
84	- Advisory: https://github.com/advisories/GHSA-35jh-r3h4-6jhm
85
86	#### [HIGH] django@3.2.0 (pip)
87	- CVE: CVE-2023-36053
88	- Title: Potential ReDoS in EmailValidator
89	- Fixed in: 3.2.20
90	- Advisory: https://osv.dev/vulnerability/PYSEC-2023-100
91
92	### Tool Availability
93	\| Ecosystem \| Tool \| Status \| Install Hint \|
94	\|-----------\|------\|--------\|--------------\|
95	\| npm \| npm audit \| ✓ installed \| — \|
96	\| pip \| pip-audit \| ✗ missing \| `pip install pip-audit` \|
97	\| cargo \| cargo-audit \| ✗ missing \| `cargo install cargo-audit` \|
98	```
99
100	## Handling Missing Tools
101
102	When an audit tool is not installed, the skill:
103	1. Reports it as a warning (not a failure)
104	2. Provides the install command for the missing tool
105	3. Continues scanning other detected ecosystems
106
107	Install hints per ecosystem:
108
109	\| Tool \| Install Command \|
110	\|------\|----------------\|
111	\| `pip-audit` \| `pip install pip-audit` \|
112	\| `cargo-audit` \| `cargo install cargo-audit` \|
113	\| `govulncheck` \| `go install golang.org/x/vuln/cmd/govulncheck@latest` \|
114	\| `bundle-audit` \| `gem install bundler-audit` \|
115	\| `composer` \| Built-in since Composer 2.4 \|
116
117	## Rules
118
119	- Never modify `package-lock.json`, `Cargo.lock`, or other lock files without `--fix` flag
120	- Always report tool availability — missing tool is a finding, not a failure
121	- Parse JSON output when a

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

cve-scan

161stars21forks

View on GitHub

How to install cve-scan?

softspark/ai-toolkit/cve-scan

$npx -y skills add softspark/ai-toolkit --skill cve-scan

Installs into the current project.

Summary

Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart). Triggers: CVE scan, vulnerability scan, npm audit, pip audit.

Files · 1

View on GitHub

SKILL.md

1	# /cve-scan - Dependency CVE Scanner
2
3	$ARGUMENTS
4
5	Detect project ecosystems and scan dependencies for known vulnerabilities using native audit tools. Zero external dependencies — uses tools already installed in the project environment.
6
7	## Usage
8
9	```
10	/cve-scan # Auto-detect all ecosystems, scan all
11	/cve-scan --ecosystem npm # Force specific ecosystem
12	/cve-scan --fix # Auto-fix where possible (npm audit fix, etc.)
13	/cve-scan --json # Machine-readable JSON output
14	```
15
16	## What This Command Does
17
18	1. Detect package managers by lock/manifest files in the project
19	2. Run the native audit command for each detected ecosystem
20	3. Parse results into a unified severity-based report
21	4. Report CVE IDs, affected packages, installed vs fixed versions, advisory links
22	5. Fix automatically when `--fix` is passed (where the tool supports it)
23
24	## Ecosystem Detection & Commands
25
26	\| Manifest File \| Lock File \| Ecosystem \| Audit Command \| CVE Database \|
27	\|---------------\|-----------\|-----------\|---------------\|--------------\|
28	\| `package.json` \| `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` \| npm/yarn/pnpm \| `npm audit --json` / `yarn audit --json` / `pnpm audit --json` \| GitHub Advisory DB \|
29	\| `requirements.txt` / `pyproject.toml` / `setup.py` \| `requirements.txt` \| pip \| `pip-audit --format=json` \| OSV / PyPI Advisory \|
30	\| `composer.json` \| `composer.lock` \| composer \| `composer audit --format=json` \| Packagist / FriendsOfPHP \|
31	\| `Cargo.toml` \| `Cargo.lock` \| cargo \| `cargo audit --json` \| RustSec Advisory DB \|
32	\| `go.mod` \| `go.sum` \| go \| `govulncheck ./...` \| Go Vulnerability DB \|
33	\| `Gemfile` \| `Gemfile.lock` \| bundler \| `bundle-audit check` \| Ruby Advisory DB \|
34	\| `pubspec.yaml` \| `pubspec.lock` \| dart/flutter \| `dart pub outdated --json` \| pub.dev \|
35
36	## Steps
37
38	1. Detect ecosystems: Glob for manifest/lock files at project root and common subdirectories
39	2. Check tool availability: Verify audit tool is installed for each detected ecosystem
40	3. Run audit: Execute native audit command, capture JSON output where available
41	4. Parse results: Extract CVE ID, package name, installed version, fixed version, severity, advisory URL
42	5. Unified report: Merge all ecosystems into single report sorted by severity
43	6. Fix mode: If `--fix` passed, run `npm audit fix`, `pip-audit --fix`, `cargo audit fix` etc.
44	7. Exit code: Non-zero if any CRITICAL or HIGH vulnerabilities found
45
46	## Detection Script
47
48	Run the bundled detection script to quickly identify ecosystems and tool availability:
49
50	```bash
51	python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py
52	```
53
54	Options:
55	```bash
56	python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --json # JSON output
57	python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --fix # Auto-fix mode
58	python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --ecosystem npm # Specific ecosystem
59	```
60
61	## Output Format
62
63	```markdown
64	## CVE Scan Report
65
66	### Ecosystems Detected
67	- npm (package-lock.json) — `npm audit` available ✓
68	- pip (requirements.txt) — `pip-audit` not installed ⚠️
69
70	### Summary
71	\| Severity \| Count \|
72	\|----------\|-------\|
73	\| CRITICAL \| 1 \|
74	\| HIGH \| 3 \|
75	\| MEDIUM \| 5 \|
76	\| LOW \| 2 \|
77
78	### Findings
79
80	#### [CRITICAL] lodash@4.17.20 (npm)
81	- CVE: CVE-2021-23337
82	- Title: Prototype Pollution
83	- Fixed in: 4.17.21
84	- Advisory: https://github.com/advisories/GHSA-35jh-r3h4-6jhm
85
86	#### [HIGH] django@3.2.0 (pip)
87	- CVE: CVE-2023-36053
88	- Title: Potential ReDoS in EmailValidator
89	- Fixed in: 3.2.20
90	- Advisory: https://osv.dev/vulnerability/PYSEC-2023-100
91
92	### Tool Availability
93	\| Ecosystem \| Tool \| Status \| Install Hint \|
94	\|-----------\|------\|--------\|--------------\|
95	\| npm \| npm audit \| ✓ installed \| — \|
96	\| pip \| pip-audit \| ✗ missing \| `pip install pip-audit` \|
97	\| cargo \| cargo-audit \| ✗ missing \| `cargo install cargo-audit` \|
98	```
99
100	## Handling Missing Tools
101
102	When an audit tool is not installed, the skill:
103	1. Reports it as a warning (not a failure)
104	2. Provides the install command for the missing tool
105	3. Continues scanning other detected ecosystems
106
107	Install hints per ecosystem:
108
109	\| Tool \| Install Command \|
110	\|------\|----------------\|
111	\| `pip-audit` \| `pip install pip-audit` \|
112	\| `cargo-audit` \| `cargo install cargo-audit` \|
113	\| `govulncheck` \| `go install golang.org/x/vuln/cmd/govulncheck@latest` \|
114	\| `bundle-audit` \| `gem install bundler-audit` \|
115	\| `composer` \| Built-in since Composer 2.4 \|
116
117	## Rules
118
119	- Never modify `package-lock.json`, `Cargo.lock`, or other lock files without `--fix` flag
120	- Always report tool availability — missing tool is a finding, not a failure
121	- Parse JSON output when a

People who liked this also viewed

6 picks

Type