cve-watch

name	cve-watch
description	Scans the project's dependency manifests (package.json / requirements.txt / pyproject.toml / Cargo.toml / go.mod / Gemfile / composer.json) for known CVEs via OSV.dev, cross-references the VulnPulse live feed for CVEs published in the last 24 hours, and returns a prioritized patch list. Use this skill when the user asks to "check my dependencies for vulnerabilities", "audit my repo for CVEs", "what should I patch first", "scan for vulns", "security audit my deps", "show me CVEs in this project", or any equivalent ask. Trigger automatically when the user mentions a CVE-by-id (e.g., "is CVE-2026-XXXXX in my code?"). Skip when the user is asking for a static-analysis / linting style audit (different skill).
allowed-tools	Read, Bash, Grep, Glob

CVE Watch — defender-side dependency scan

Scans dependency manifests in the current project and reports prioritized CVEs.

When to Use This Skill

Invoke automatically when the user asks any of:

• "check my deps for CVEs" / "audit my repo for CVEs"
• "what should I patch first?" / "is my project vulnerable?"
• "is CVE-2026-XXXXX in my code?"
• "security audit my dependencies"
• "scan for vulns"

Skip for: linter/static-analysis requests, license-audit requests, secret-scanner requests (these are separate skills).

How It Works

The skill uses OSV.dev (Google's Open Source Vulnerability database — free, comprehensive, no auth required) as the primary backend. It supplements with VulnPulse's live feed (vulnpulse.ivixivi.workers.dev/api/digest/latest) for CVEs published in the last 24h that may not have propagated to OSV yet.

Step-by-step

1. Detect dependency manifests

Run from the project root:

ls package.json requirements.txt pyproject.toml Cargo.toml go.mod Gemfile composer.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null

Identify which ecosystems are present.

2. Run the bundled checker script

python3 "$(dirname "$0")/scripts/check_deps.py" --root . --output table

The script:

• Parses each manifest into (ecosystem, package, version) tuples
• Batches a query to POST https://api.osv.dev/v1/querybatch
• Returns vulnerabilities grouped by severity
• Adds a "today's CVE" section from VulnPulse cross-reference
• Outputs Markdown table or JSON (via --output json)

3. Surface the prioritized list

Report in this order:

1. CRITICAL (CVSS ≥ 9.0) — patch this hour
2. HIGH (CVSS 7.0–8.9) — patch this week
3. MEDIUM (CVSS 4.0–6.9) — patch this sprint
4. LOW — defer or accept

For each item show:

• CVE ID + CVSS score
• Affected package + version range
• Fixed version (if known)
• One-line impact summary
• Direct link to the OSV / NVD record

4. Suggest the patch command

For the top-N most-critical packages, output the exact upgrade command for the user's ecosystem (e.g., npm install lodash@^4.17.22, pip install --upgrade django>=4.2.7).

5. If "today's CVE" cross-reference returns hits

Highlight separately in a "🔥 Published today" section. These are most-likely-not-yet-in- your-attention CVEs.

Output Format

## CVE Watch — <date>

Scanned: <ecosystem-list> · <package-count> packages

### 🔴 CRITICAL — patch this hour

| CVE | Package | Current | Fixed | Impact |
|-----|---------|---------|-------|--------|
| CVE-2026-XXXXX (9.8) | foo@1.2.3 | 1.2.3 | 1.2.5 | RCE via crafted input |

### 🟠 HIGH — patch this week

(...)

### 🔥 Published today (cross-referenced from VulnPulse)

(...)

### Recommended patch commands

```bash
npm install foo@^1.2.5
pip install --upgrade bar>=2.0.4

## Privacy

The script sends only `(ecosystem, package, version)` tuples to OSV.dev. No project source
code or paths leave the machine. OSV.dev is operated by Google's Open Source Security Team.

## Limitations

- Transitive dependencies via lock files are best-effort parsed; if your lock file format
  is exotic the script may miss deeply-nested deps
- Pre-release / git-pinned dependencies are skipped (no version to query)
- VulnPulse cross-reference only covers last 24h; older CVEs come from OSV
- This is a fast triage, not a replacement for `npm audit` / `pip-audit` / `cargo audit` —
  it complements them by adding the VulnPulse "today" layer and a cross-ecosystem unified
  view

## Example Invocation Flow

User: "check my repo for CVEs"

Claude:
1. Detects `package.json` + `requirements.txt`
2. Runs `python3 scripts/check_deps.py --root . --output table`
3. Reads stdout, presents the prioritized table
4. Suggests `npm install ...` and `pip install ...` commands
5. Asks: "Apply these upgrades now?"

## Author

Built by [Anthony Padavano (4444J99)](https://github.com/4444J99). Part of an intelligence
portfolio that includes:

- [VulnPulse](https://vulnpulse.ivixivi.workers.dev) — defender-side CVE feed (used as a backend here)
- [BountyScope](https://bountyscope.ivixivi.workers.dev) — bug-bounty intel + smart-contract analyzer
- [TrendPulse](https://trendpulse.ivixivi.workers.dev) — daily emerging-tech digest
- [PromptScope](https://promptscope.ivixivi.workers.dev), [WriteLens](https://writelens.ivixivi.workers.dev), [EdgarFlash](https://edgarflash.ivixivi.workers.dev)

For freelance security audit work or custom skill development, see
[https://github.com/4444J99](https://github.com/4444J99) — currently taking engagements.