dependency-vulnerability-audit

name	dependency-vulnerability-audit
description	How to perform security audits on package-lock.json. Use this skill whenever you need to identify HIGH or CRITICAL vulnerabilities in project dependencies.

Dependency Vulnerability Audit

This skill outlines the process for auditing package-lock.json for security vulnerabilities.

Audit Workflow

1. Scan: Use trivy in offline mode to scan package-lock.json.
   • Ensure the Trivy DB is present at /root/.cache/trivy/db/trivy.db.
   • Execute: trivy fs --db-repository /root/.cache/trivy/db --offline-scan --format json package-lock.json > scan_results.json
2. Filter: Parse the scan_results.json to filter for vulnerabilities with Severity of HIGH or CRITICAL.
3. Data Extraction: Extract the following fields:
   • Package Name
   • Installed Version
   • CVE ID
   • Severity Level
   • CVSS Score
   • Fixed Version (if available)
   • Title
   • Reference URL
4. Validation: Verify the extracted information against NVD/GHSA if necessary using cvss-score-extraction skill.