sca-blackduck

name	sca-blackduck
description	Software Composition Analysis (SCA) using Synopsys Black Duck for identifying open source vulnerabilities, license compliance risks, and supply chain security threats with CVE, CWE, and OWASP framework mapping. Use when: (1) Scanning dependencies for known vulnerabilities and security risks, (2) Analyzing open source license compliance and legal risks, (3) Identifying outdated or unmaintained dependencies, (4) Integrating SCA into CI/CD pipelines for continuous dependency monitoring, (5) Providing remediation guidance for vulnerable dependencies with CVE and CWE mappings, (6) Assessing supply chain security risks and third-party component threats.
version	0.1.0
maintainer	SirAppSec
category	appsec
tags	["sca","blackduck","dependency-scanning","vulnerability-management","license-compliance","supply-chain","cve","owasp"]
frameworks	["OWASP","CWE","NIST","SOC2","PCI-DSS"]
dependencies	{"tools":["docker","git","detect"],"access":["blackduck-url","api-token"]}
references	["https://sig-product-docs.synopsys.com/bundle/bd-hub/page/Welcome.html","https://owasp.org/www-project-dependency-check/","https://nvd.nist.gov/","https://www.cisa.gov/sbom"]

Software Composition Analysis with Black Duck

Overview

Perform comprehensive Software Composition Analysis (SCA) using Synopsys Black Duck to identify security vulnerabilities, license compliance risks, and supply chain threats in open source dependencies. This skill provides automated dependency scanning, vulnerability detection with CVE mapping, license risk analysis, and remediation guidance aligned with OWASP and NIST standards.

Quick Start

Scan a project for dependency vulnerabilities:

# Using Black Duck Detect (recommended)
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
  --blackduck.url=$BLACKDUCK_URL \
  --blackduck.api.token=$BLACKDUCK_TOKEN \
  --detect.project.name="MyProject" \
  --detect.project.version.name="1.0.0"

Scan with policy violation enforcement:

# Fail build on policy violations
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
  --blackduck.url=$BLACKDUCK_URL \
  --blackduck.api.token=$BLACKDUCK_TOKEN \
  --detect.policy.check.fail.on.severities=BLOCKER,CRITICAL

Core Workflows

Workflow 1: Initial Dependency Security Assessment

Progress: [ ] 1. Identify package managers and dependency manifests in codebase [ ] 2. Run scripts/blackduck_scan.py with project detection [ ] 3. Analyze vulnerability findings categorized by severity (CRITICAL, HIGH, MEDIUM, LOW) [ ] 4. Map CVE findings to CWE and OWASP Top 10 categories [ ] 5. Review license compliance risks and policy violations [ ] 6. Generate prioritized remediation report with upgrade recommendations

Work through each step systematically. Check off completed items.

Workflow 2: Vulnerability Remediation

1. Review scan results and identify critical/high severity vulnerabilities
2. For each vulnerability:
   • Check if fixed version is available
   • Review breaking changes in upgrade path
   • Consult references/remediation_strategies.md for vulnerability-specific guidance
3. Apply dependency updates using package manager
4. Re-scan to validate fixes
5. Document any vulnerabilities accepted as risk with justification

Workflow 3: License Compliance Analysis

1. Run Black Duck scan with license risk detection enabled
2. Review components flagged with license compliance issues