Scans the project's dependency manifests (package.json / requirements.txt / pyproject.toml / Cargo.toml / go.mod / Gemfile / composer.json) for known CVEs via OSV.dev, cross-references the VulnPulse live feed for CVEs published in the last 24 hours, and returns a prioritized patch list. Use this skill when the user asks to "check my dependencies for vulnerabilities", "audit my repo for CVEs", "what should I patch first", "scan for vulns", "security audit my deps", "show me CVEs in this project", or any equivalent ask. Trigger automatically when the user mentions a CVE-by-id (e.g., "is CVE-2026-XXXXX in my code?"). Skip when the user is asking for a static-analysis / linting style audit (different skill).
2026-05-04