Scan Project Dependencies for Security Vulnerabilities

This skill covers dependency security analysis, vulnerability assessment, and supply chain security across languages and package managers. It classifies vulnerabilities into four severity tiers - critical (remote code execution, privilege escalation, data leaks), high (authentication bypass, injection vulnerabilities, cryptographic issues), medium (information disclosure, denial of service, input validation gaps), and low (configuration issues, deprecated features, minor leaks) - and applies a risk framework that weighs exploitability and attack complexity, confidentiality/integrity/availability impact, transitive dependency depth, and the actual attack surface in context.

It provides multi-language scanning commands: npm audit and yarn audit plus Snyk (npx snyk test, npx snyk monitor) for Node.js; Safety, Bandit, and pip-audit for Python; the OWASP dependency-check Maven plugin (with a configurable CVSS build-failure threshold and a suppression file) for Java; and govulncheck plus Nancy for Go. It covers automated pipeline integration with a GitHub Actions workflow (Snyk scan at a severity threshold, OWASP Dependency Check, SARIF upload) and a Jenkins pipeline running OWASP and Snyk checks in parallel and marking the build unstable when vulnerabilities are found, plus policy configuration via Dependabot (scheduled updates, PR limits, reviewers, commit-message conventions) and an OWASP suppression file for accepted-risk CVEs with expiry dates.

It also covers license compliance scanning (an allow-list checker for Node.js, and FOSSA CLI for broader analysis), container security via a multi-stage Docker build that installs only production dependencies and drops to a non-root user, and a custom Python vulnerability checker that queries the NVD CVE database for a given package and version.

npm audit --audit-level=moderate
npm audit fix --force

Use this skill when setting up or hardening dependency security for a project - choosing scanners per language, wiring vulnerability scanning into CI/CD, configuring Dependabot and suppression policies, or adding license compliance and container-security checks.

It is not a fit for application-level security testing (SAST/DAST of your own code logic) beyond dependencies, or for incident response on an already-exploited vulnerability - the guidance is scoped to identifying, triaging, and continuously monitoring third-party dependency risk.

Inputs are your project's package manifests (package.json, requirements.txt, pom.xml, go.mod) and language/package-manager mix. Outputs are working scanner commands and CI configuration, plus policy artifacts this skill also covers: dependency-pinning guidance paired with automated security updates, dependency-approval workflows for vetting new packages before they're added, and a recommendation to keep historical vulnerability data for trend analysis over time.

Beyond the language scanners and CI systems already named, the skill's risk-mitigation guidance covers runtime application self-protection (RASP) where applicable, monitoring for typosquatting and malicious packages, and periodic third-party security assessments and penetration testing as an outside check on the automated scanning.

Security and platform engineers establishing dependency-security practices - severity-based remediation SLAs (critical within 24 hours, high within 72), SBOM maintenance, defense-in-depth scanning across multiple tools, private registries for vetted dependencies, and mean-time-to-remediation tracking for stakeholder and auditor reporting.