Menú
Use when: auditing dependency vulnerabilities with OSV.dev queries for lockfile packages and CVE triage.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
| name | dependencyAudit |
| description | Use when: auditing dependency vulnerabilities with OSV.dev queries for lockfile packages and CVE triage. |
| type | reference |
| version | 1.1 |
| license | MIT |
Skill metadata: version "1.1"; tags [security, dependencies, audit, osv]; recommended tools [query_osv, query_deps].
Use this skill in workspaces with the secure pack selected.
Query known CVEs for project dependencies with the registered security MCP server when it is connected. If the server is unavailable, fall back to OSV.dev directly or a native package-manager audit command and normalize the results to the same package/version/CVE fields.
secureReviewWhen the security MCP server is connected, prefer these tools:
query_osv(package, version, ecosystem)
package: exact package name as it appears in the lockfileversion: exact installed version stringecosystem: PyPI, npm, crates.io, Go, Maven, Hex, NuGet, RubyGems, Packagist, Pub, Linux, or GitHub Actionsquery_deps(package, version, system)
package: exact package name as it appears in the lockfileversion: exact installed version stringsystem: pypi, npm, cargo, go, maven, nuget, rubygems, packagist, hex, or pubIf the security MCP server is unavailable, extract the package/version pairs from the lockfile and query OSV.dev directly or run the ecosystem's native audit command, then report the results with the same package, version, severity, and fix-version fields.
| CVSS score | Severity | Action |
|---|---|---|
| 9.0–10.0 | Critical | Block release — must fix before shipping |
| 7.0–8.9 | High | Fix before release unless no viable upgrade path |
| 4.0–6.9 | Medium | Fix in next planned dependency update cycle |
| 0.1–3.9 | Low | Track; fix opportunistically |
fixed-in field from the OSV result — upgrade to that version or laterIf batch_query_lockfile returns zero vulnerabilities, report: "No known vulnerabilities found in <lockfile> as of <query date>." Do not treat a clean result as a permanent guarantee.
security MCP tools or an explicit documented fallback for all direct dependenciesUse when running workspace tests, choosing a test command, or summarizing results before handoff to debugger.
Use when running workspace tests, choosing a test command, or summarizing results before handoff to debugger.
Use when: running pre-commit or pre-push CI-equivalent checks in any workspace — discovers workflow commands with Cursor tools, filters for local executability, scopes to staged changes, and runs checks cheapest-first.
Use when the user wants to install or customize cursorAssistant in the current project (GitHub install or configure).
Use when: running pre-commit or pre-push CI-equivalent checks in any workspace — discovers workflow commands with Cursor tools, filters for local executability, scopes to staged changes, and runs checks cheapest-first.
Use when: discovering package manifests, assessing dependency health, finding replacements, or confirming import usage before removal — discovery only; mutating installs are handled by the deps agent.