Skills security-scanning-security-dependencies

📦

security-scanning-security-dependencies

Name: security-scanning-security-dependencies
Author: sickn33

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Scan Dependency Security Risks

Dependency vulnerabilities and license risks are difficult to track across ecosystems. This skill guides scanning, prioritization, SBOM creation, and remediation planning.

Supports: Claude Codex Code(CC)

📊 70 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "security-scanning-security-dependencies" from https://skillstore.io/skills/sickn33-security-scanning-security-dependencies.md and its manifest at https://skillstore.io/api/skills/sickn33-security-scanning-security-dependencies/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-security-scanning-security-dependencies.md Signed manifest GET /api/skills/sickn33-security-scanning-security-dependencies/manifest Signed lockfile GET /api/skills/sickn33-security-scanning-security-dependencies/lockfile

Test it

Using "security-scanning-security-dependencies". A Node.js service has package files and a request to assess release readiness.

Expected outcome:

The report identifies npm as the ecosystem, lists critical and high issues first, names fixed versions, and recommends blocking release until tests pass.

Using "security-scanning-security-dependencies". A mixed Python and Go repository needs scheduled security checks.

Expected outcome:

The workflow recommendation includes separate scanner steps, saved artifacts, threshold rules for critical findings, and an owner for remediation review.

Using "security-scanning-security-dependencies". A compliance team requests supply chain evidence for an application.

Expected outcome:

The response summarizes SBOM coverage, vulnerable components, unresolved license questions, and follow-up actions for audit evidence.

Security Audit

Medium Risk

v6 • 7/9/2026 Open versioned report

The static command and filesystem alerts are mostly safe examples for dependency scanning, not hidden executable behavior. No prompt injection, credential exfiltration, or malicious network intent was found. The main residual risk is the automated update workflow, which can modify dependencies and should require explicit approval and testing.

Files scanned

589

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

resources/implementation-playbook.md:381-428

Automated Dependency Update Workflow Can Modify Projects

The automated update script runs package manager update and fix commands that can change dependency manifests, lockfiles, and installed packages. This is useful for remediation but needs explicit user approval and test validation.

The script clearly performs update and fix workflows for npm, Python, and Go. The skill includes approval guidance, so the issue is controlled but still operationally significant.

Risk Factors

⚙️ External commands (8)

resources/implementation-playbook.md:116 resources/implementation-playbook.md:148 resources/implementation-playbook.md:179 resources/implementation-playbook.md:211 resources/implementation-playbook.md:374 resources/implementation-playbook.md:384 SKILL.md:34 SKILL.md:43

🌐 Network access (1)

resources/implementation-playbook.md:471

📁 Filesystem access (10)

resources/implementation-playbook.md:374 resources/implementation-playbook.md:126 resources/implementation-playbook.md:158 resources/implementation-playbook.md:221 resources/implementation-playbook.md:239 resources/implementation-playbook.md:259 resources/implementation-playbook.md:289 resources/implementation-playbook.md:318 resources/implementation-playbook.md:455 resources/implementation-playbook.md:487

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-security-scanning-security-dependencies/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-security-scanning-security-dependencies/security.svg)](https://skillstore.io/skills/sickn33-security-scanning-security-dependencies?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-security-scanning-security-dependencies?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-security-scanning-security-dependencies/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-security-scanning-security-dependencies.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). security-scanning-security-dependencies security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-security-scanning-security-dependencies/audits/6

BibTeX citation

@techreport{sickn33-sickn33-security-scanning-security-dependencies-2026,
  author = {sickn33},
  title = {security-scanning-security-dependencies security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/sickn33-security-scanning-security-dependencies/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-scanning-security-dependencies security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-security-scanning-security-dependencies/audits/6"
identifiers:
  - type: other
    value: "skillstore:sickn33-security-scanning-security-dependencies:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Audit Release Dependencies

Scan dependency files before a release and identify critical fixes that must block deployment.

Prepare Compliance Evidence

Generate SBOM-oriented inventory notes and summarize vulnerable packages for compliance review.

Standardize Repository Checks

Create repeatable CI dependency scanning steps for teams using several package ecosystems.

Try These Prompts

Scan One Project

Scan this project for dependency vulnerabilities. Identify the package ecosystems, required tools, and the highest priority remediation steps.

Review Lockfiles

Review the dependency manifests and lockfiles in this repository. Summarize vulnerable packages, fixed versions, and test steps before changes.

Plan CI Scanning

Design a dependency security scanning workflow for this repository. Include scan cadence, failure thresholds, artifacts, and ownership guidance.

Prioritize Remediation Program

Analyze dependency risk across ecosystems and create a remediation plan using severity, exploitability, fix availability, release impact, and SBOM needs.

Best Practices

Run scans on a regular schedule and before high-risk releases.
Prioritize fixes using severity, exploit availability, and application exposure.
Test every dependency update before merging remediation changes.

Avoid

Running auto-fix commands without explicit approval and review.
Treating scanner output as complete without checking false positives.
Ignoring lockfiles when assessing actual deployed dependency versions.

Frequently Asked Questions

What ecosystems does this skill cover?

It covers npm, Python, Go, and Rust examples, with patterns that can be adapted to other package managers.

Can it generate an SBOM?

It provides guidance for SBOM-style component inventory and CycloneDX-oriented reporting, but output depends on available project data.

Does it automatically fix vulnerabilities?

It includes remediation examples, but dependency changes should run only after explicit approval and testing.

Does it need network access?

Many scanners query vulnerability databases or package registries, so network access may be required for current results.

Can it evaluate license risk?

It can guide license review and flag packages for follow-up, but legal decisions need qualified review.

Is it suitable for CI pipelines?

Yes. It includes CI scanning patterns, thresholds, saved artifacts, and scheduled scan guidance.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security-scanning-security-dependencies

Ref

26421118b848d9f1efc0aa169d8a7a9e7e0a877e

Maintenance freshness

7/18/2026

Usage

7 downloads · 106 views

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md