| name | tracing-transitive-vulnerabilities |
| description | Build a dependency-tree map of a project (npm or Python) and trace
the path from each known-vulnerable transitive package back to one
or more direct dependencies. Identifies which direct-dep bump would
clear the most findings at once (highest-leverage upgrade), which
vulnerabilities are unreachable through any version bump and
require overrides or vendor-patch, and which CVEs sit at deep
transitive depth (3+ levels from a direct dep) where blast-radius
triage is hardest.
Use when: a multi-finding audit produces noise and you need to
prioritize, when planning a major dependency refresh, after an
upstream package compromise hits your tree (e.g. event-stream
flatmap-stream), or when an audit shows findings that automated
fix commands cannot auto-resolve.
Threshold: any HIGH or CRITICAL CVE reachable only through
transitive paths that no single direct-dep bump can clear.
Trigger with: "trace transitive vulns", "find dep paths", "SBOM
vuln trace", "which direct dep pulls this CVE".
|
| allowed-tools | ["Read","Bash(npm:*)","Bash(pip:*)","Bash(pip-audit:*)","Bash(python3:*)","Bash(pipdeptree:*)","Glob"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)","Bash(npm install:*)","Bash(pip install:*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","sbom","transitive-dependency","dependency-graph","pentest"] |
Tracing Transitive Vulnerabilities
Overview
The auditing-npm-dependencies and auditing-python-dependencies skills
each surface CVEs, but they don't answer the question that actually
decides remediation order: which of these findings can I clear by
bumping ONE direct dep, and which require deeper intervention?
That question is the core of supply-chain triage. A high-CVSS CVE
in lodash@4.17.4 is alarming on first read. If it's pulled in by
five different direct deps, the right fix may not be to bump any of
them — it may be a single root-level overrides entry pinning
lodash@^4.17.21. The triage discussion goes very differently when
you can quote: "this CVE is reachable via 5 paths, all of which
flow through webpack, which has a fixed version available." That
shifts a project-wide panic to a one-line PR.
This skill walks the project's dependency graph (via npm ls,
pipdeptree, or equivalent), intersects it with the CVE findings
already produced by the per-language audit skills, and emits a
trace report that includes:
- For each CVE: the full path(s) from direct dep → ... → vulnerable package
- For each direct dep: the count of CVEs reachable through it
- "Highest-leverage upgrade" recommendation — the single direct-dep
bump that clears the most findings at once
- "Unreachable" findings — CVEs whose vulnerable version range is
forced by EVERY parent in the path, requiring overrides or
vendor-patch
- "Deep transitive" findings (≥3 levels from a direct dep) — these
are highest-risk for hidden surprises because the relationship to
your code is most opaque
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| Critical CVE at deep transitive depth (≥3) | HIGH | Depth ≥3 + severity CRITICAL — blast radius unclear | CWE-1395 |
| High CVE reachable only via overrides | HIGH | No direct-dep version clears the finding | CWE-1395 |
| Multi-CVE direct-dep hotspot | MEDIUM | Single direct dep is ancestor for ≥3 separate CVEs | (informational) |
| Direct-dep bump clears N findings | INFO | Reports the recommended bump | (operational) |
| Unreachable CVE (no fix in any reachable version) |
