tracing-transitive-vulnerabilities

name	tracing-transitive-vulnerabilities
description	Build a dependency-tree map of a project (npm or Python) and trace the path from each known-vulnerable transitive package back to one or more direct dependencies. Identifies which direct-dep bump would clear the most findings at once (highest-leverage upgrade), which vulnerabilities are unreachable through any version bump and require overrides or vendor-patch, and which CVEs sit at deep transitive depth (3+ levels from a direct dep) where blast-radius triage is hardest. Use when: a multi-finding audit produces noise and you need to prioritize, when planning a major dependency refresh, after an upstream package compromise hits your tree (e.g. event-stream flatmap-stream), or when an audit shows findings that automated fix commands cannot auto-resolve. Threshold: any HIGH or CRITICAL CVE reachable only through transitive paths that no single direct-dep bump can clear. Trigger with: "trace transitive vulns", "find dep paths", "SBOM vuln trace", "which direct dep pulls this CVE".
allowed-tools	["Read","Bash(npm:*)","Bash(pip:*)","Bash(pip-audit:*)","Bash(python3:*)","Bash(pipdeptree:*)","Glob"]
disallowed-tools	["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)","Bash(npm install:*)","Bash(pip install:*)"]
version	3.30.0
author	Jeremy Longshore <[e-mail]>
license	MIT
compatibility	Designed for Claude Code
tags	["security","sbom","transitive-dependency","dependency-graph","pentest"]

Tracing Transitive Vulnerabilities

Overview

The auditing-npm-dependencies and auditing-python-dependencies skills each surface CVEs, but they don't answer the question that actually decides remediation order: which of these findings can I clear by bumping ONE direct dep, and which require deeper intervention?

That question is the core of supply-chain triage. A high-CVSS CVE in lodash@4.17.4 is alarming on first read. If it's pulled in by five different direct deps, the right fix may not be to bump any of them — it may be a single root-level overrides entry pinning lodash@^4.17.21. The triage discussion goes very differently when you can quote: "this CVE is reachable via 5 paths, all of which flow through webpack, which has a fixed version available." That shifts a project-wide panic to a one-line PR.

This skill walks the project's dependency graph (via npm ls, pipdeptree, or equivalent), intersects it with the CVE findings already produced by the per-language audit skills, and emits a trace report that includes:

• For each CVE: the full path(s) from direct dep → ... → vulnerable package
• For each direct dep: the count of CVEs reachable through it
• "Highest-leverage upgrade" recommendation — the single direct-dep bump that clears the most findings at once
• "Unreachable" findings — CVEs whose vulnerable version range is forced by EVERY parent in the path, requiring overrides or vendor-patch
• "Deep transitive" findings (≥3 levels from a direct dep) — these are highest-risk for hidden surprises because the relationship to your code is most opaque

When the skill produces findings

Finding	Severity	Threshold	Affected control
Critical CVE at deep transitive depth (≥3)	HIGH	Depth ≥3 + severity CRITICAL — blast radius unclear	CWE-1395
High CVE reachable only via overrides	HIGH	No direct-dep version clears the finding	CWE-1395
Multi-CVE direct-dep hotspot	MEDIUM	Single direct dep is ancestor for ≥3 separate CVEs	(informational)
Direct-dep bump clears N findings	INFO	Reports the recommended bump	(operational)
Unreachable CVE (no fix in any reachable version)