Dep Vuln Scanner

该 Skill 运行 Python 脚本读取 package.json、requirements.txt 或 go.mod，将依赖信息发送至 OSV.dev，输出按严重级别标记的漏洞报告，并支持 JSON 与按生态过滤；发现漏洞时返回非零退出码。

johnnywang2001

热度 82.00

最近更新 2026-05-11 17:34:47

分类：安全依赖：代码执行 / 读写文件 / 第三方 API应用场景：代码审查 / DevOps / 自动化脚本 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add dep-vuln-scanner

Metadata

name: dep-vuln-scanner
description: Scan project dependencies for known security vulnerabilities using the OSV.dev API. Supports npm (package.json), Python/pip (requirements.txt), and Go (go.mod). Use when checking a project for vulnerable packages, auditing dependencies before deployment, or investigating CVEs in third-party libraries. No API key required.

Dependency Vulnerability Scanner

Scan project dependencies against the OSV.dev vulnerability database. Zero config, no API keys.

Quick Start

# Scan current directory (auto-detects project type)
python3 scripts/dep_vuln_scan.py .

# Scan a specific project
python3 scripts/dep_vuln_scan.py /path/to/project

# JSON output for CI/CD
python3 scripts/dep_vuln_scan.py . --json

# Scan only npm dependencies
python3 scripts/dep_vuln_scan.py . --ecosystem npm

Supported Ecosystems

File	Ecosystem
`package.json`	npm
`requirements.txt`	PyPI
`go.mod`	Go

Multiple files in the same directory are scanned together.

Output

Color-coded severity: CRITICAL/HIGH (red), MEDIUM (yellow), LOW (green)
Includes CVE aliases, vulnerability IDs, and descriptions
Summary with total count and critical/high breakdown
Exit code 1 if any vulnerabilities found (useful for CI gates)

Flags

--json — Machine-readable JSON output
--ecosystem <name> — Filter by ecosystem (repeatable)