| name | java-vulnerability-manager |
| description | Intelligent Java dependency vulnerability detection, triage, and remediation for Maven and Gradle projects. Produces a CVE report with scores, traces vulnerability origins through transitive graphs, and delivers a prioritized fix plan — handling version mediation rules, BOM overrides, exclusions, and shaded-JAR edge cases.
|
| version | 2.0.0 |
| kind | pipeline |
| triggers | ["fix vulnerabilities in java project","remove vulnerable dependencies","java cve scan","dependency vulnerability report","owasp dependency check","upgrade vulnerable jars","fix transitive dependency"] |
| intent | execution |
| guardrails | ["Copy helper scripts to a .vuln/ subfolder at the project root and chmod +x before running.","Always run vuln-scan.sh BEFORE editing pom.xml or build.gradle — it creates the baseline snapshot vuln-validate.sh diffs against.","Never remove a dependency without confirming it is not a direct compile/runtime requirement.","Distinguish transitive from direct before choosing a fix — the wrong approach causes silent runtime failures.","Prefer version-constraint fixes (dependencyManagement / constraints) over blanket exclusions. Exclusions are a last resort.","Run vuln-validate.sh after every fix batch — never batch all fixes without intermediate validation.","Every false positive needs vuln-suppress.sh with a documented rationale. Never suppress silently or hand-edit the XML.","Never downgrade a dependency to resolve a CVE — only upgrade.","If a fix needs a major version bump (breaking API), flag it for human review rather than applying it.","When M2_HOME is set it is the shared Maven local repository — pass it through (-Dmaven.repo.local=\"$M2_HOME\") on every scan and validate run, or resolution differs between the scan and the build."] |
| resources | ["<SKILL_PATH>/scripts/vuln-scan.sh","<SKILL_PATH>/scripts/vuln-trace.sh","<SKILL_PATH>/scripts/vuln-validate.sh","<SKILL_PATH>/scripts/vuln-suppress.sh"] |
| tools | ["bash"] |
| created_at | 2026-05-30T00:00:00.000Z |
| updated_at | 2026-07-29T00:00:00.000Z |
Java vulnerability manager
Detect, triage, and remediate dependency CVEs in Maven and Gradle projects.
Scripts
| script | role |
|---|
vuln-scan.sh | Runs OWASP Dependency-Check + Grype, classifies DIRECT vs TRANSITIVE, merges results, writes the triage report and the JSON baseline snapshot. |
vuln-trace.sh | For a groupId:artifactId, traces every chain pulling it in, surfaces scope, version conflicts, and existing constraints, and emits the correct Maven/Gradle fix snippet. |
vuln-validate.sh | Post-fix: verifies resolution, compiles, tests, re-scans, and diffs CVE count before vs after. |
vuln-suppress.sh | Generates documented OWASP suppression XML with category, reviewer, and optional expiry. Supports --list and --expire-check. |
Setup — Deploy Helper Scripts
Copy the helper scripts into the project before starting any scan:
mkdir -p .vuln
cp <SKILL_PATH>/scripts/vuln-*.sh .vuln/
chmod +x .vuln/vuln-*.sh
The four scripts and their roles in the workflow:
| Script | Purpose | When to run |
|---|
vuln-scan.sh | OWASP + Grype scan, DIRECT/TRANSITIVE classification, triage report | First — establishes baseline |
vuln-trace.sh | Full dependency chain trace, conflict detection, fix snippet generator | For every TRANSITIVE finding |
vuln-validate.sh | Compile + test + re-scan + before/after CVE diff | After every fix batch |
vuln-suppress.sh | Documented suppression entry generator, expiry auditor | For confirmed false positives |
Output
vuln-scan.sh writes the full report and a JSON snapshot to the output directory
and prints the paths. Work from the triage report; open the raw scanner output
only to investigate a specific finding. The JSON snapshot is the handle
uses for before/after diffing — do not delete it mid-remediation.
