cve-scan

Featured

Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart). Triggers: CVE scan, vulnerability scan, npm audit, pip audit.

AI & Automation 161 stars 21 forks Updated yesterday Apache-2.0

Install

View on GitHub

Quality Score: 93/100

Stars 20%
74
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# /cve-scan - Dependency CVE Scanner $ARGUMENTS Detect project ecosystems and scan dependencies for known vulnerabilities using native audit tools. Zero external dependencies — uses tools already installed in the project environment. ## Usage ``` /cve-scan # Auto-detect all ecosystems, scan all /cve-scan --ecosystem npm # Force specific ecosystem /cve-scan --fix # Auto-fix where possible (npm audit fix, etc.) /cve-scan --json # Machine-readable JSON output ``` ## What This Command Does 1. **Detect** package managers by lock/manifest files in the project 2. **Run** the native audit command for each detected ecosystem 3. **Parse** results into a unified severity-based report 4. **Report** CVE IDs, affected packages, installed vs fixed versions, advisory links 5. **Fix** automatically when `--fix` is passed (where the tool supports it) ## Ecosystem Detection & Commands | Manifest File | Lock File | Ecosystem | Audit Command | CVE Database | |---------------|-----------|-----------|---------------|--------------| | `package.json` | `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` | npm/yarn/pnpm | `npm audit --json` / `yarn audit --json` / `pnpm audit --json` | GitHub Advisory DB | | `requirements.txt` / `pyproject.toml` / `setup.py` | `requirements.txt` | pip | `pip-audit --format=json` | OSV / PyPI Advisory | | `composer.json` | `composer.lock` | composer | `composer audit --format=json` | Packagist / Fr...

Details

Author
softspark
Repository
softspark/ai-toolkit
Created
4 months ago
Last Updated
yesterday
Language
Python
License
Apache-2.0

Integrates with

Anthropic · AI

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

deps-audit

Use when auditing, updating, or securing project dependencies. Covers multi-language dependency detection, security vulnerability scanning, outdated package identification, unused dependency detection, and update strategies for npm, pip, cargo, and go.

4 Updated 3 days ago
Sagargupta16
AI & Automation Solid

code-vuln-audit

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.

4 Updated 1 weeks ago
serejaris
AI & Automation Featured

code-vuln-audit

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.

4,441 Updated 2 days ago
zebbern