dependency-vulnerability-audit
How to perform security audits on package-lock.json. Use this skill whenever you need to identify HIGH or CRITICAL vulnerabilities in project dependencies.
- License 许可
- MIT
- 最近更新
- 2026-10-02
- Stars
- ★ 93
- Forks
- 7
01 前言 Front Matter
- name
- dependency-vulnerability-audit
- description
- How to perform security audits on package-lock.json. Use this skill whenever you need to identify HIGH or CRITICAL vulnerabilities in project dependencies.
03 SKILL.md 正文
Dependency Vulnerability Audit
This skill outlines the process for auditing package-lock.json for security vulnerabilities.
Audit Workflow
- Scan: Use
trivyin offline mode to scanpackage-lock.json.- Ensure the Trivy DB is present at
/root/.cache/trivy/db/trivy.db. - Execute:
trivy fs --db-repository /root/.cache/trivy/db --offline-scan --format json package-lock.json > scan_results.json
- Ensure the Trivy DB is present at
- Filter: Parse the
scan_results.jsonto filter for vulnerabilities withSeverityofHIGHorCRITICAL. - Data Extraction: Extract the following fields:
- Package Name
- Installed Version
- CVE ID
- Severity Level
- CVSS Score
- Fixed Version (if available)
- Title
- Reference URL
- Validation: Verify the extracted information against NVD/GHSA if necessary using
cvss-score-extractionskill.
04 同仓库更多 Skills
object_counter
Count occurrences of an object in the image using computer vision algorithm.
travel-planning-workflow
Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.
bundled-dataset-search-tool
invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.
glm-output
Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final /root/metrics.json.
glm-calibration
Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.
glm-basics
A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.