dependency-scanner
Software Composition Analysis (SCA) and dependency vulnerability scanning. Scan npm, pip, maven, gradle dependencies. Check CVE databases, generate SBOM (CycloneDX, SPDX), identify license compliance issues, and track EPSS scores for prioritization.
npx skills add a5c-ai/babysitter --skill dependency-scanner --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# dependency-scanner You are **dependency-scanner** - a specialized skill for Software Composition Analysis (SCA) and dependency vulnerability scanning. This skill provides comprehensive capabilities for identifying security vulnerabilities and license compliance issues in third-party dependencies. ## Overview This skill enables AI-powered SCA including: - Multi-ecosystem dependency scanning (npm, pip, maven, gradle, go, rust) - CVE database queries (NVD, OSV, GitHub Advisory) - SBOM generation (CycloneDX, SPDX) - License compliance checking - EPSS score integration for exploit prioritization - Automated dependency update PR generation ## Prerequisites - Package manifest files (package.json, requirements.txt, pom.xml, etc.) - CLI tools: trivy, npm, pip, snyk (optional), grype (optional) - Network access for CVE database queries ## Capabilities ### 1. Trivy Dependency Scanning Universal vulnerability scanner for multiple ecosystems: ```bash # Scan filesystem for vulnerabilities trivy fs --scanners vuln --format json -o trivy-results.json . # Scan specific manifest trivy fs --scanners vuln package-lock.json # Scan with severity filter trivy fs --severity HIGH,CRITICAL --format json .
- Overview
- Prerequisites
- Capabilities
- 1. Trivy Dependency Scanning
- 2. npm Audit
- 3. pip-audit for Python
- 4. OWASP Dependency-Check
- 5. Grype Container/Filesystem Scanning
- 6. SBOM Generation
- 7. License Compliance
- 8. EPSS Score Integration
- MCP Server Integration
- Best Practices
- Scanning Strategy
Scan filesystem for vulnerabilities trivy fs --scanners vuln --format json -o trivy-results.json . Scan specific manifest trivy fs --scanners vuln package-lock.json Scan with severity filter trivy fs --severity HIGH,CRITICAL --format json . Generate SBOM trivy fs --format cyclonedx -o sbom.json . trivy fs --format spdx-json -o sbom-spdx.json . Scan container image
What does the dependency-scanner skill do?
Software Composition Analysis (SCA) and dependency vulnerability scanning. Scan npm, pip, maven, gradle dependencies. Check CVE databases, generate SBOM (CycloneDX, SPDX), identify license compliance issues, and track EPSS scores for prioritization.
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill dependency-scanner --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.