Stats
Actions
Tags
From claude-skills-cicd
Scan the user's CURRENT repository (or a remote GitHub URL) for KNOWN VULNERABILITIES in third-party dependencies using OSV/GHSA advisory databases. Detects ecosystem from manifest files (pyproject.toml/requirements.txt, package.json/package-lock.json, Cargo.toml, go.mod) and runs the matching auditor (pip-audit, npm audit, cargo audit, govulncheck). Default behaviour reads `$PWD` (no clone). Use this when the user asks to "audit dependencies", "run pip-audit", "npm audit", "check for vulnerable packages", "are any of my deps CVE-flagged", "is lodash safe", "any CVEs in our packages", "scan our requirements.txt", "check our Cargo.lock for advisories", or "any GHSA hits in our manifest". For SAST or secret scans on YOUR OWN source code, use security-scan. For lint/test, use lint-and-test. For build/publish, use build-and-release. Read-only.
How this skill is triggered — by the user, by Claude, or both
Slash command
/claude-skills-cicd:dependency-auditThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Look up known CVEs in the project's third-party dependencies. **Read-only**: never modifies manifests, never pushes to a registry.
Look up known CVEs in the project's third-party dependencies. Read-only: never modifies manifests, never pushes to a registry.
Don't use for: vulnerabilities in the project's OWN code (SAST) → that's security-scan. Lint/test → lint-and-test. Build/release → build-and-release.
python skills/dependency-audit/scripts/run.py
The script reads $PWD, validates .git/, walks the manifest files, and fans out to per-ecosystem auditors.
Optional flags:
--ecosystems python,node,rust,go (default: auto-detect from manifest files)python skills/dependency-audit/scripts/run.py \
--repo-url https://github.com/psf/requests --ref main
{
"ok": true,
"ecosystems_detected": ["python"],
"findings_by_ecosystem": {
"python": {
"tool": "pip-audit",
"vulnerabilities": [
{"package": "requests", "id": "GHSA-...", "severity": "high", "fix_versions": ["2.32.0"]}
]
}
},
"summary": {"critical": 0, "high": 1, "medium": 0, "low": 0, "total": 1},
"cache_key": "..."
}
If a scanner binary is missing (e.g. pip-audit not on PATH), the per-ecosystem entry has error: "binary not installed" and an empty vulnerabilities list. The skill does not crash; that ecosystem is simply skipped.
security-scan.result.ok and per-ecosystem error keys.https://github.com/ accepted in --repo-url.npx claudepluginhub kevinweisl/claude-skills-cicd --plugin claude-skills-cicdProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.