Skills security-scanning-security-dependencies
📦

security-scanning-security-dependencies

Content revision r2 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Scan Dependencies for Vulnerabilities

Dependency risks are difficult to compare across package ecosystems. This skill organizes scanner results, prioritizes findings, and prepares practical remediation and reporting guidance.

Supports: Claude Codex Code(CC)
📊 69 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "security-scanning-security-dependencies" from https://skillstore.io/skills/sickn33-security-scanning-security-dependencies.md and its manifest at https://skillstore.io/api/skills/sickn33-security-scanning-security-dependencies/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-security-scanning-security-dependencies.md Signed manifest GET /api/skills/sickn33-security-scanning-security-dependencies/manifest Signed lockfile GET /api/skills/sickn33-security-scanning-security-dependencies/lockfile

Test it

Using "security-scanning-security-dependencies". Review an npm project with two high findings and one available patch.

Expected outcome:

  • Summary: Two high-severity findings affect production dependencies.
  • Priority: Apply the compatible patch first, then rerun tests and npm audit.
  • Verification: Confirm the lockfile changed only expected packages.

Using "security-scanning-security-dependencies". Create a remediation plan for Python and Go scan results.

Expected outcome:

  • Immediate: Address reachable critical and high findings with available fixes.
  • Planned: Test transitive upgrades in isolated branches.
  • Deferred: Document accepted risks with owners and review dates.

Using "security-scanning-security-dependencies". Summarize dependency scan evidence for a release review.

Expected outcome:

The release report lists affected packages, advisory identifiers, severity, available fixes, accepted risks, and the date of the latest successful scan.

Security Audit

Medium Risk
v7 • 8/26/2026 Open versioned report

All 22 static findings are false positives caused by fixed-argument scanner commands, ordinary Python loops, shell syntax, Markdown formatting, and safety guidance. Contextual review found unpinned scanner installations and CI error suppression that can weaken scan integrity.

2
Files scanned
597
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
resources/implementation-playbook.md:356resources/implementation-playbook.md:363resources/implementation-playbook.md:514-525
Unpinned Security Tool Installation
The playbook installs scanners without pinned versions and uses @latest. Unexpected or compromised releases could enter CI and local environments.
The cited commands explicitly install unversioned packages and govulncheck@latest. This is a direct supply-chain reproducibility risk.
Medium
resources/implementation-playbook.md:350resources/implementation-playbook.md:357-358resources/implementation-playbook.md:364resources/implementation-playbook.md:374-378
Suppressed Scanner Failures Can Produce False Assurance
Several CI commands ignore scanner failures. Missing or malformed reports can bypass the later text count and allow an incomplete scan to pass.
The workflow explicitly applies || true to scan commands and checks only matched output text afterward. Scanner errors are not distinguished from clean results.

Risk Factors

⚙️ External commands (8)
resources/implementation-playbook.md:116 resources/implementation-playbook.md:148 resources/implementation-playbook.md:179 resources/implementation-playbook.md:211 resources/implementation-playbook.md:374 resources/implementation-playbook.md:384 SKILL.md:37 SKILL.md:46
🌐 Network access (1)
resources/implementation-playbook.md:471
📁 Filesystem access (10)
resources/implementation-playbook.md:374 resources/implementation-playbook.md:126 resources/implementation-playbook.md:158 resources/implementation-playbook.md:221 resources/implementation-playbook.md:239 resources/implementation-playbook.md:259 resources/implementation-playbook.md:289 resources/implementation-playbook.md:318 resources/implementation-playbook.md:455 resources/implementation-playbook.md:487
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-security-scanning-security-dependencies/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-security-scanning-security-dependencies/security.svg)](https://skillstore.io/skills/sickn33-security-scanning-security-dependencies?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-security-scanning-security-dependencies?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-security-scanning-security-dependencies/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-security-scanning-security-dependencies.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). security-scanning-security-dependencies security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-security-scanning-security-dependencies/audits/7

BibTeX citation

@techreport{sickn33-sickn33-security-scanning-security-dependencies-2026, author = {sickn33}, title = {security-scanning-security-dependencies security audit report (audit version 7)}, institution = {Skillstore}, year = {2026}, number = {7}, url = {https://skillstore.io/skills/sickn33-security-scanning-security-dependencies/audits/7}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "security-scanning-security-dependencies security audit report (audit version 7)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-08-26" url: "https://skillstore.io/skills/sickn33-security-scanning-security-dependencies/audits/7" identifiers: - type: other value: "skillstore:sickn33-security-scanning-security-dependencies:audit:7" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Audit a Pull Request

Review changed lockfiles, identify newly introduced vulnerabilities, and propose verified package updates.

Standardize CI Scanning

Create consistent dependency checks and severity gates across repositories with different package ecosystems.

Prepare Supply Chain Evidence

Produce vulnerability summaries and SBOM guidance for release reviews and compliance evidence.

Try These Prompts

Scan One Project 
Inspect this repository's dependency manifests. Identify the ecosystems, recommend read-only scanners, and summarize vulnerabilities without changing files.
Prioritize Findings 
Analyze these dependency scan results. Rank remediation by severity, exploitability, runtime exposure, fix availability, and likely upgrade impact.
Plan Safe Remediation 
Create a staged remediation plan for these vulnerable packages. Separate low-risk patches from breaking upgrades and define tests and rollback checks.
Design Multi-Ecosystem CI 
Design dependency scanning for npm, Python, Go, and Rust. Pin tools, preserve reports, detect scanner failures, and enforce configurable severity policies.

Best Practices

  • Run read-only scans before proposing dependency changes.
  • Pin scanner versions and verify tool installation sources.
  • Test updates and preserve reports for comparison and rollback.

Avoid

  • Do not apply automatic fixes without explicit approval.
  • Do not treat scanner errors or missing reports as clean results.
  • Do not prioritize only by severity without checking exposure and fix impact.

Frequently Asked Questions

Which ecosystems does this skill cover?
The examples cover npm, Python, Go, and Rust dependency scanning.
Does the skill change dependencies automatically?
It provides update examples, but its safety guidance requires approval before running automatic fixes.
Can it generate an SBOM?
It includes CycloneDX-style generation logic, but the example lists vulnerable components rather than every installed dependency.
Does it replace security review?
No. Scanner findings require validation against application exposure, advisory quality, and upgrade impact.
Can it run without network access?
Some local analysis may work, but vulnerability databases and tool installation commonly require network access.
How should CI handle scanner failures?
CI should distinguish execution errors from clean results, preserve reports, and fail when required evidence is missing.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security-scanning-security-dependencies

Ref

4804b3d672af16b8afca785bbb6c5d7c7400a78f

Maintenance freshness

8/26/2026

Usage

9 downloads · 106 views

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md

More from sickn33

View all

Related Skills

View all