[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F5DWF0GXQCSBAKGR7WBJYN":3,"skill-same:01M6F5DWF0GXQCSBAKGR7WBJYN":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":29,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M6F5DWF0GXQCSBAKGR7WBJYN","dependency-scanning",null,"Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-dependency-scanning\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"dependency scanning","scanning","dependency","2026","safe","for","relevant","scripts","scope","active","scan","main","community","agent-skills","only","devops-security","owasp","dependabot","package","license","assessment","security","2026-11-10 10:12:30",false,"---\nname: dependency-scanning\ndescription: Scan package dependencies for known vulnerabilities using Snyk, Dependabot,\n  and OWASP Dependency-Check.\ncategory: security\nrisk: safe\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant security tooling (scanners, vault CLIs) and an\n  authorized scope for any active assessment. Docs-only; helper scripts and templates\n  not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# Dependency Scanning\n\nIdentify vulnerabilities in third-party dependencies and libraries.\n\n## When to Use This Skill\n\nUse this skill when:\n- Managing third-party dependencies\n- Implementing software composition analysis\n- Meeting compliance requirements\n- Securing the software supply chain\n- Automating vulnerability detection\n\n## Scan and exception boundaries\n\nInventory every relevant manifest\u002Flockfile, including nested projects; a clean root scan does not cover them. Review tools at fixed versions and scan with lifecycle scripts disabled where supported. Some scanners upload dependency metadata or source, so confirm permitted data\u002Faccount scope. `fix`, `--force`, ignores and suppressions mutate dependencies or policy: review diffs and test before adopting them. Historical suppression IDs\u002Fdates are examples, never reusable approval; bind each real exception to evidence, owner and expiry. A missing vulnerable-function call is not automatically a false positive or a license exemption.\n\n## Prerequisites\n\n- Package manifest files (package.json, requirements.txt, etc.)\n- CI\u002FCD pipeline access\n- Dependency scanning tool\n\n## Tool Comparison\n\n| Tool | Type | Languages | Best For |\n|------|------|-----------|----------|\n| Snyk | Commercial\u002FFree | Many | Comprehensive SCA |\n| Dependabot | Free (GitHub) | Many | Automated PRs |\n| OWASP Dep-Check | OSS | Many | Free scanning |\n| npm audit | Built-in | Node.js | Quick checks |\n| pip-audit | OSS | Python | Python projects |\n| Trivy | OSS | Many | Container deps |\n\n## Snyk\n\n### CLI Usage\n\n```bash\n# Install\nnpm install -g snyk\n\n# Authenticate\nsnyk auth\n\n# Test project\nsnyk test\n\n# Monitor project (track over time)\nsnyk monitor\n\n# Test specific manifest\nsnyk test --file=package.json\nsnyk test --file=requirements.txt\n\n# Output formats\nsnyk test --json > snyk-results.json\nsnyk test --sarif > snyk-results.sarif\n\n# Fix vulnerabilities\nsnyk fix\n\n# Ignore vulnerability\nsnyk ignore --id=SNYK-JS-LODASH-567746 --expiry=2024-12-31 --reason=\"No exploit path\"\n```\n\n### CI Integration\n\n```text\nNON-EXECUTABLE CI DESIGN: before adoption, use least-privilege jobs, pin every action to a reviewed full SHA, and provision verified fixed-version tools in a digest-pinned runner image. Never expose credentials during tool provisioning.\n# .github\u002Fworkflows\u002Fsnyk.yml\nname: Snyk Security\n\non:\n  push:\n    branches: [main]\n  pull_request:\n\njobs:\n  snyk:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run Snyk to check for vulnerabilities\n        step: Run the preinstalled reviewed Snyk binary\n        env:\n          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}\n        with:\n          args: --severity-threshold=high\n\n      - name: Upload results to GitHub\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        with:\n          sarif_file: snyk.sarif\n```\n\n### Policy File\n\n```yaml\n# .snyk\nversion: v1.25.0\nignore:\n  SNYK-JS-LODASH-567746:\n    - '*':\n        reason: No user input reaches this function\n        expires: 2024-12-31\n        created: 2024-01-15\n\n  'snyk:lic:npm:gpl-3.0':\n    - '*':\n        reason: Internal use only\n        \npatch: {}\n```\n\n## GitHub Dependabot\n\n### Configuration\n\n```yaml\n# .github\u002Fdependabot.yml\nversion: 2\nupdates:\n  # JavaScript\u002FNode.js\n  - package-ecosystem: \"npm\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"weekly\"\n      day: \"monday\"\n    open-pull-requests-limit: 10\n    reviewers:\n      - \"security-team\"\n    labels:\n      - \"dependencies\"\n      - \"security\"\n    ignore:\n      - dependency-name: \"aws-sdk\"\n        update-types: [\"version-update:semver-major\"]\n    groups:\n      development-dependencies:\n        dependency-type: \"development\"\n        update-types:\n          - \"minor\"\n          - \"patch\"\n\n  # Python\n  - package-ecosystem: \"pip\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"daily\"\n    \n  # Docker\n  - package-ecosystem: \"docker\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"weekly\"\n    \n  # GitHub Actions\n  - package-ecosystem: \"github-actions\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"weekly\"\n```\n\n### Security Alerts\n\n```yaml\n# Automated security updates\n# Enable in repository Settings > Security > Dependabot\n\n# Dependabot will automatically:\n# - Create PRs for vulnerable dependencies\n# - Update to patched versions\n# - Provide CVE details in PR description\n```\n\n## OWASP Dependency-Check\n\n### Installation\n\n```bash\n# Download\nwget https:\u002F\u002Fgithub.com\u002Fjeremylong\u002FDependencyCheck\u002Freleases\u002Fdownload\u002Fv9.0.0\u002Fdependency-check-9.0.0-release.zip\nunzip dependency-check-9.0.0-release.zip\n\n# Or via Homebrew\nbrew install dependency-check\n```\n\n### Usage\n\n```bash\n# Scan project\ndependency-check --project \"MyProject\" \\\n  --scan \u002Fpath\u002Fto\u002Fproject \\\n  --out \u002Fpath\u002Fto\u002Freports \\\n  --format HTML \\\n  --format JSON\n\n# With specific analyzers\ndependency-check --project \"MyProject\" \\\n  --scan . \\\n  --enableExperimental \\\n  --disableRetireJS\n\n# CI configuration\ndependency-check --project \"MyProject\" \\\n  --scan . \\\n  --format JSON \\\n  --failOnCVSS 7 \\\n  --suppression suppression.xml\n```\n\n### Suppression File\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!-- suppression.xml -->\n\u003Csuppressions xmlns=\"https:\u002F\u002Fjeremylong.github.io\u002FDependencyCheck\u002Fdependency-suppression.1.3.xsd\">\n  \u003Csuppress>\n    \u003Cnotes>False positive - not using vulnerable function\u003C\u002Fnotes>\n    \u003CpackageUrl regex=\"true\">^pkg:npm\u002Flodash@.*$\u003C\u002FpackageUrl>\n    \u003Ccve>CVE-2021-23337\u003C\u002Fcve>\n  \u003C\u002Fsuppress>\n  \n  \u003Csuppress until=\"2024-12-31\">\n    \u003Cnotes>Risk accepted - mitigated by WAF\u003C\u002Fnotes>\n    \u003Ccpe>cpe:\u002Fa:apache:struts:2.5.0\u003C\u002Fcpe>\n    \u003CvulnerabilityName>CVE-2023-12345\u003C\u002FvulnerabilityName>\n  \u003C\u002Fsuppress>\n\u003C\u002Fsuppressions>\n```\n\n### Maven Integration\n\n```xml\n\u003C!-- pom.xml -->\n\u003Cplugin>\n  \u003CgroupId>org.owasp\u003C\u002FgroupId>\n  \u003CartifactId>dependency-check-maven\u003C\u002FartifactId>\n  \u003Cversion>9.0.0\u003C\u002Fversion>\n  \u003Cconfiguration>\n    \u003CfailBuildOnCVSS>7\u003C\u002FfailBuildOnCVSS>\n    \u003CsuppressionFiles>\n      \u003CsuppressionFile>suppression.xml\u003C\u002FsuppressionFile>\n    \u003C\u002FsuppressionFiles>\n  \u003C\u002Fconfiguration>\n  \u003Cexecutions>\n    \u003Cexecution>\n      \u003Cgoals>\n        \u003Cgoal>check\u003C\u002Fgoal>\n      \u003C\u002Fgoals>\n    \u003C\u002Fexecution>\n  \u003C\u002Fexecutions>\n\u003C\u002Fplugin>\n```\n\n## Language-Specific Tools\n\n### Node.js (npm audit)\n\n```bash\n# Run audit\nnpm audit\n\n# JSON output\nnpm audit --json\n\n# Fix automatically\nnpm audit fix\n\n# Fix with breaking changes\nnpm audit fix --force\n\n# Production only\nnpm audit --production\n```\n\n### Python (pip-audit)\n\n```bash\n# Install\npip install pip-audit\n\n# Scan installed packages\npip-audit\n\n# Scan requirements file\npip-audit -r requirements.txt\n\n# Output formats\npip-audit --format json\npip-audit --format cyclonedx-json\n\n# Fix vulnerabilities\npip-audit --fix\n```\n\n### Go (govulncheck)\n\n```bash\n# Install\ngo install golang.org\u002Fx\u002Fvuln\u002Fcmd\u002Fgovulncheck@latest\n\n# Scan project\ngovulncheck .\u002F...\n\n# JSON output\ngovulncheck -json .\u002F...\n```\n\n### Ruby (bundler-audit)\n\n```bash\n# Install\ngem install bundler-audit\n\n# Update database\nbundle-audit update\n\n# Run audit\nbundle-audit check\n\n# Output format\nbundle-audit check --format json\n```\n\n## SBOM Generation\n\n### CycloneDX\n\n```bash\n# Node.js\nnpx @cyclonedx\u002Fcyclonedx-npm --output-file sbom.json\n\n# Python\npip install cyclonedx-bom\ncyclonedx-py -o sbom.json\n\n# Go\ngo install github.com\u002FCycloneDX\u002Fcyclonedx-gomod\u002Fcmd\u002Fcyclonedx-gomod@latest\ncyclonedx-gomod mod -json > sbom.json\n```\n\n### Syft\n\n```bash\n# Install\n# Tool prerequisite: use a verified preinstalled binary; no network installer runs here.\n\n# Generate SBOM\nsyft dir:\u002Fpath\u002Fto\u002Fproject -o cyclonedx-json > sbom.json\nsyft dir:\u002Fpath\u002Fto\u002Fproject -o spdx-json > sbom-spdx.json\n\n# From container\nsyft myimage:latest -o cyclonedx-json > sbom.json\n```\n\n## CI\u002FCD Pipeline\n\n```text\nNON-EXECUTABLE CI DESIGN: before adoption, use least-privilege jobs, pin every action to a reviewed full SHA, and provision verified fixed-version tools in a digest-pinned runner image. Never expose credentials during tool provisioning.\n# Comprehensive dependency scanning\nname: Dependency Security\n\non:\n  push:\n    branches: [main]\n  pull_request:\n  schedule:\n    - cron: '0 8 * * *'\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: npm audit\n        run: npm audit --audit-level=high\n\n      - name: Snyk scan\n        step: Run the preinstalled reviewed Snyk binary\n        env:\n          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}\n        with:\n          args: --severity-threshold=high\n          \n      - name: Generate SBOM\n        run: npx @cyclonedx\u002Fcyclonedx-npm --output-file sbom.json\n\n      - name: Upload SBOM\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: sbom\n          path: sbom.json\n```\n\n## Common Issues\n\n### Issue: Too Many Alerts\n**Problem**: Overwhelmed by vulnerability count\n**Solution**: Prioritize by exploitability, filter by severity\n\n### Issue: No Fix Available\n**Problem**: Vulnerable dependency has no patch\n**Solution**: Consider alternatives, implement compensating controls\n\n### Issue: Breaking Updates\n**Problem**: Security fix breaks functionality\n**Solution**: Review changelogs, test thoroughly, use lockfiles\n\n## Best Practices\n\n- Scan on every build\n- Use lockfiles for reproducibility\n- Set severity thresholds\n- Generate and track SBOMs\n- Document exceptions properly\n- Update dependencies regularly\n- Monitor for new vulnerabilities\n- Automate PR creation for updates\n\n## Related Skills\n\n- sast-scanning (`sast-scanning`) - Code vulnerabilities\n- container-scanning (`container-scanning`) - Container dependencies\n- github-actions (`github-actions`) - CI integration\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# Dependency Scanning\n\nIdentify vulnerabilities in third-party dependencies and libraries.\n\n## When to Use This Skill\n\nUse this skill when:\n- Managing third-party dependencies\n- Implementing software composition analysis\n- Meeting compliance requirements\n- Securing the software supply chain\n- Automating vulnerability detection\n\n## Scan and exception boundaries\n\nInventory every relevant manifest\u002Flockfile, including nested projects; a clean root scan does not cover them. Review tools at fixed versions and scan with lifecycle scripts disabled where supported. Some scanners upload dependency metadata or source, so confirm permitted data\u002Faccount scope. `fix`, `--force`, ignores and suppressions mutate dependencies or policy: review diffs and test before adopting them. Historical suppression IDs\u002Fdates are examples, never reusable approval; bind each real exception to evidence, owner and expiry. A missing vulnerable-function call is not automatically a false positive or a license exemption.\n\n## Prerequisites\n\n- Package manifest files (package.json, requirements.txt, etc.)\n- CI\u002FCD pipeline access\n- Dependency scanning tool\n\n## Tool Comparison\n\n| Tool | Type | Languages | Best For |\n|------|------|-----------|----------|\n| Snyk | Commercial\u002FFree | Many | Comprehensive SCA |\n| Dependabot | Free (GitHub) | Many | Automated PRs |\n| OWASP Dep-Check | OSS | Many | Free scanning |\n| npm audit | Built-in | Node.js | Quick checks |\n| pip-audit | OSS | Python | Python projects |\n| Trivy | OSS | Many | Container deps |\n\n## Snyk\n\n### CLI Usage\n\n```bash\n# Install\nnpm install -g snyk\n\n# Authenticate\nsnyk auth\n\n# Test project\nsnyk test\n\n# Monitor project (track over time)\nsnyk monitor\n\n# Test specific manifest\nsnyk test --file=package.json\nsnyk test --file=requirements.txt\n\n# Output formats\nsnyk test --json > snyk-results.json\nsnyk test --sarif > snyk-results.sarif\n\n# Fix vulnerabilities\nsnyk fix\n\n# Ignore vulnerability\nsnyk ignore --id=SNYK-JS-LODASH-567746 --expiry=2024-12-31 --reason=\"No exploit path\"\n```\n\n### CI Integration\n\n```text\nNON-EXECUTABLE CI DESIGN: before adoption, use least-privilege jobs, pin every action to a reviewed full SHA, and provision verified fixed-version tools in a digest-pinned runner image. Never expose credentials during tool provisioning.\n# .github\u002Fworkflows\u002Fsnyk.yml\nname: Snyk Security\n\non:\n  push:\n    branches: [main]\n  pull_request:\n\njobs:\n  snyk:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run Snyk to check for vulnerabilities\n        step: Run the preinstalled reviewed Snyk binary\n        env:\n          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}\n        with:\n          args: --severity-threshold=high\n\n      - name: Upload results to GitHub\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        with:\n          sarif_file: snyk.sarif\n```\n\n### Policy File\n\n```yaml\n# .snyk\nversion: v1.25.0\nignore:\n  SNYK-JS-LODASH-567746:\n    - '*':\n        reason: No user input reaches this function\n        expires: 2024-12-31\n        created: 2024-01-15\n\n  'snyk:lic:npm:gpl-3.0':\n    - '*':\n        reason: Internal use only\n        \npatch: {}\n```\n\n## GitHub Dependabot\n\n### Configuration\n\n```yaml\n# .github\u002Fdependabot.yml\nversion: 2\nupdates:\n  # JavaScript\u002FNode.js\n  - package-ecosystem: \"npm\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"weekly\"\n      day: \"monday\"\n    open-pull-requests-limit: 10\n    reviewers:\n      - \"security-team\"\n    labels:\n      - \"dependencies\"\n      - \"security\"\n    ignore:\n      - dependency-name: \"aws-sdk\"\n        update-types: [\"version-update:semver-major\"]\n    groups:\n      development-dependencies:\n        dependency-type: \"development\"\n        update-types:\n          - \"minor\"\n          - \"patch\"\n\n  # Python\n  - package-ecosystem: \"pip\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"daily\"\n    \n  # Docker\n  - package-ecosystem: \"docker\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"weekly\"\n    \n  # GitHub Actions\n  - package-ecosystem: \"github-actions\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"weekly\"\n```\n\n### Security Alerts\n\n```yaml\n# Automated security updates\n# Enable in repository Settings > Security > Dependabot\n\n# Dependabot will automatically:\n# - Create PRs for vulnerable dependencies\n# - Update to patched versions\n# - Provide CVE details in PR description\n```\n\n## OWASP Dependency-Check\n\n### Installation\n\n```bash\n# Download\nwget https:\u002F\u002Fgithub.com\u002Fjeremylong\u002FDependencyCheck\u002Freleases\u002Fdownload\u002Fv9.0.0\u002Fdependency-check-9.0.0-release.zip\nunzip dependency-check-9.0.0-release.zip\n\n# Or via Homebrew\nbrew install dependency-check\n```\n\n### Usage\n\n```bash\n# Scan project\ndependency-check --project \"MyProject\" \\\n  --scan \u002Fpath\u002Fto\u002Fproject \\\n  --out \u002Fpath\u002Fto\u002Freports \\\n  --format HTML \\\n  --format JSON\n\n# With specific analyzers\ndependency-check --project \"MyProject\" \\\n  --scan . \\\n  --enableExperimental \\\n  --disableRetireJS\n\n# CI configuration\ndependency-check --project \"MyProject\" \\\n  --scan . \\\n  --format JSON \\\n  --failOnCVSS 7 \\\n  --suppression suppression.xml\n```\n\n### Suppression File\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!-- suppression.xml -->\n\u003Csuppressions xmlns=\"https:\u002F\u002Fjeremylong.github.io\u002FDependencyCheck\u002Fdependency-suppression.1.3.xsd\">\n  \u003Csuppress>\n    \u003Cnotes>False positive - not using vulnerable function\u003C\u002Fnotes>\n    \u003CpackageUrl regex=\"true\">^pkg:npm\u002Flodash@.*$\u003C\u002FpackageUrl>\n    \u003Ccve>CVE-2021-23337\u003C\u002Fcve>\n  \u003C\u002Fsuppress>\n  \n  \u003Csuppress until=\"2024-12-31\">\n    \u003Cnotes>Risk accepted - mitigated by WAF\u003C\u002Fnotes>\n    \u003Ccpe>cpe:\u002Fa:apache:struts:2.5.0\u003C\u002Fcpe>\n    \u003CvulnerabilityName>CVE-2023-12345\u003C\u002FvulnerabilityName>\n  \u003C\u002Fsuppress>\n\u003C\u002Fsuppressions>\n```\n\n### Maven Integration\n\n```xml\n\u003C!-- pom.xml -->\n\u003Cplugin>\n  \u003CgroupId>org.owasp\u003C\u002FgroupId>\n  \u003CartifactId>dependency-check-maven\u003C\u002FartifactId>\n  \u003Cversion>9.0.0\u003C\u002Fversion>\n  \u003Cconfiguration>\n    \u003CfailBuildOnCVSS>7\u003C\u002FfailBuildOnCVSS>\n    \u003CsuppressionFiles>\n      \u003CsuppressionFile>suppression.xml\u003C\u002FsuppressionFile>\n    \u003C\u002FsuppressionFiles>\n  \u003C\u002Fconfiguration>\n  \u003Cexecutions>\n    \u003Cexecution>\n      \u003Cgoals>\n        \u003Cgoal>check\u003C\u002Fgoal>\n      \u003C\u002Fgoals>\n    \u003C\u002Fexecution>\n  \u003C\u002Fexecutions>\n\u003C\u002Fplugin>\n```\n\n## Language-Specific Tools\n\n### Node.js (npm audit)\n\n```bash\n# Run audit\nnpm audit\n\n# JSON output\nnpm audit --json\n\n# Fix automatically\nnpm audit fix\n\n# Fix with breaking changes\nnpm audit fix --force\n\n# Production only\nnpm audit --production\n```\n\n### Python (pip-audit)\n\n```bash\n# Install\npip install pip-audit\n\n# Scan installed packages\npip-audit\n\n# Scan requirements file\npip-audit -r requirements.txt\n\n# Output formats\npip-audit --format json\npip-audit --format cyclonedx-json\n\n# Fix vulnerabilities\npip-audit --fix\n```\n\n### Go (govulncheck)\n\n```bash\n# Install\ngo install golang.org\u002Fx\u002Fvuln\u002Fcmd\u002Fgovulncheck@latest\n\n# Scan project\ngovulncheck .\u002F...\n\n# JSON output\ngovulncheck -json .\u002F...\n```\n\n### Ruby (bundler-audit)\n\n```bash\n# Install\ngem install bundler-audit\n\n# Update database\nbundle-audit update\n\n# Run audit\nbundle-audit check\n\n# Output format\nbundle-audit check --format json\n```\n\n## SBOM Generation\n\n### CycloneDX\n\n```bash\n# Node.js\nnpx @cyclonedx\u002Fcyclonedx-npm --output-file sbom.json\n\n# Python\npip install cyclonedx-bom\ncyclonedx-py -o sbom.json\n\n# Go\ngo install github.com\u002FCycloneDX\u002Fcyclonedx-gomod\u002Fcmd\u002Fcyclonedx-gomod@latest\ncyclonedx-gomod mod -json > sbom.json\n```\n\n### Syft\n\n```bash\n# Install\n# Tool prerequisite: use a verified preinstalled binary; no network installer runs here.\n\n# Generate SBOM\nsyft dir:\u002Fpath\u002Fto\u002Fproject -o cyclonedx-json > sbom.json\nsyft dir:\u002Fpath\u002Fto\u002Fproject -o spdx-json > sbom-spdx.json\n\n# From container\nsyft myimage:latest -o cyclonedx-json > sbom.json\n```\n\n## CI\u002FCD Pipeline\n\n```text\nNON-EXECUTABLE CI DESIGN: before adoption, use least-privilege jobs, pin every action to a reviewed full SHA, and provision verified fixed-version tools in a digest-pinned runner image. Never expose credentials during tool provisioning.\n# Comprehensive dependency scanning\nname: Dependency Security\n\non:\n  push:\n    branches: [main]\n  pull_request:\n  schedule:\n    - cron: '0 8 * * *'\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: npm audit\n        run: npm audit --audit-level=high\n\n      - name: Snyk scan\n        step: Run the preinstalled reviewed Snyk binary\n        env:\n          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}\n        with:\n          args: --severity-threshold=high\n          \n      - name: Generate SBOM\n        run: npx @cyclonedx\u002Fcyclonedx-npm --output-file sbom.json\n\n      - name: Upload SBOM\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: sbom\n          path: sbom.json\n```\n\n## Common Issues\n\n### Issue: Too Many Alerts\n**Problem**: Overwhelmed by vulnerability count\n**Solution**: Prioritize by exploitability, filter by severity\n\n### Issue: No Fix Available\n**Problem**: Vulnerable dependency has no patch\n**Solution**: Consider alternatives, implement compensating controls\n\n### Issue: Breaking Updates\n**Problem**: Security fix breaks functionality\n**Solution**: Review changelogs, test thoroughly, use lockfiles\n\n## Best Practices\n\n- Scan on every build\n- Use lockfiles for reproducibility\n- Set severity thresholds\n- Generate and track SBOMs\n- Document exceptions properly\n- Update dependencies regularly\n- Monitor for new vulnerabilities\n- Automate PR creation for updates\n\n## Related Skills\n\n- sast-scanning (`sast-scanning`) - Code vulnerabilities\n- container-scanning (`container-scanning`) - Container dependencies\n- github-actions (`github-actions`) - CI integration\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":22,"source":45,"license":14,"category":39,"metadata":46,"date_added":49,"description":7,"source_repo":50,"source_type":30,"compatibility":51,"license_source":52},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills",{"author":47,"version":48},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-dependency-scanning",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-10 14:20:15",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add boisenoise\u002Fskills-collections --skill dependency-scanning",{"tool":65,"command":66},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill dependency-scanning",{"tool":68,"command":69},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill dependency-scanning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-dependency-scanning\u002FSKILL.md",true,[],[74,102,129,154,173,196],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":79,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":40},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[83,84,85,86,87,88,89,90,91,92,93,32,94,95,96,97,98,99,100,101,21],"web","access","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":106,"sourceHtmlUrl":107,"categories":108,"keywords":114,"publishedAt":40},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[109],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[104,115,116,117,86,87,37,91,118,119,120,121,122,123,124,97,125,126,127,128,21],"MCP","cli","github","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":133,"sourceHtmlUrl":134,"categories":135,"keywords":141,"publishedAt":40},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[136],{"categoryNo":137,"categoryName":138,"taxonomyType":139,"taxonomyTypeDesc":140},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[131,117,86,37,142,143,144,145,146,147,97,148,149,150,126,23,151,152,153,128,104,21],"https","email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":158,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":40},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[162,163,164,117,86,37,165,166,142,167,118,168,169,170,146,97,171,172,128,104,21],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":177,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":40},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[181,182,117,183,86,184,37,185,186,187,188,189,97,190,191,192,193,194,195,128],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":200,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":40},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[204,205,206,117,86,37,207,208,145,209,210,97,211,212,213,214,215,216,217,128],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]