cve-scan

# /cve-scan - Dependency CVE Scanner $ARGUMENTS Detect project ecosystems and scan dependencies for known vulnerabilities using native audit tools. Zero external dependencies — uses tools already installed in the project environment. ## Usage ``` /cve-scan # Auto-detect all ecosystems, scan all /cve-scan --ecosystem npm # Force specific ecosystem /cve-scan --fix # Auto-fix where possible (npm audit fix, etc.) /cve-scan --json # Machine-readable JSON output ``` ## What This Command Does 1. **Detect** package managers by lock/manifest files in the project 2. **Run** the native audit command for each detected ecosystem 3. **Parse** results into a unified severity-based report 4. **Report** CVE IDs, affected packages, installed vs fixed versions, advisory links 5. **Fix** automatically when `--fix` is passed (where the tool supports it) ## Ecosystem Detection & Commands | Manifest File | Lock File | Ecosystem | Audit Command | CVE Database | |---------------|-----------|-----------|---------------|--------------| | `package.json` | `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` | npm/yarn/pnpm | `npm audit --json` / `yarn audit --json` / `pnpm audit --json` | GitHub Advisory DB | | `requirements.txt` / `pyproject.toml` / `setup.py` | `requirements.txt` | pip | `pip-audit --format=json` | OSV / PyPI Advisory | | `composer.json` | `composer.lock` | composer | `composer audit --format=json` | Packagist / FriendsOfPHP | | `Cargo.toml` | `Cargo.lock` | cargo | `cargo audit --json` | RustSec Advisory DB | | `go.mod` | `go.sum` | go | `govulncheck ./...` | Go Vulnerability DB | | `Gemfile` | `Gemfile.lock` | bundler | `bundle-audit check` | Ruby Advisory DB | | `pubspec.yaml` | `pubspec.lock` | dart/flutter | `dart pub outdated --json` | pub.dev | ## Steps 1. **Detect ecosystems**: Glob for manifest/lock files at project root and common subdirectories 2. **Check tool availability**: Verify audit tool is installed for each detected ecosystem 3. **Run audit**: Execute native audit command, capture JSON output where available 4. **Parse results**: Extract CVE ID, package name, installed version, fixed version, severity, advisory URL 5. **Unified report**: Merge all ecosystems into single report sorted by severity 6. **Fix mode**: If `--fix` passed, run `npm audit fix`, `pip-audit --fix`, `cargo audit fix` etc. 7. **Exit code**: Non-zero if any CRITICAL or HIGH vulnerabilities found ## Detection Script Run the bundled detection script to quickly identify ecosystems and tool availability: ```bash python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py ``` Options: ```bash python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --json # JSON output python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --fix # Auto-fix mode python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --ecosystem npm # Specific ecosystem ``` ## Output Format ```markdown ## CVE Scan Report ### Ecosystems Detected - npm (package-lock.json) — `npm audit` available ✓ - pip (requirements.txt) — `pip-audit` not installed ⚠️ ### Summary | Severity | Count | |----------|-------| | CRITICAL | 1 | | HIGH | 3 | | MEDIUM | 5 | | LOW | 2 | ### Findings #### [CRITICAL] lodash@4.17.20 (npm) - **CVE**: CVE-2021-23337 - **Title**: Prototype Pollution - **Fixed in**: 4.17.21 - **Advisory**: https://github.com/advisories/GHSA-35jh-r3h4-6jhm #### [HIGH] django@3.2.0 (pip) - **CVE**: CVE-2023-36053 - **Title**: Potential ReDoS in EmailValidator - **Fixed in**: 3.2.20 - **Advisory**: https://osv.dev/vulnerability/PYSEC-2023-100 ### Tool Availability | Ecosystem | Tool | Status | Install Hint | |-----------|------|--------|--------------| | npm | npm audit | ✓ installed | — | | pip | pip-audit | ✗ missing | `pip install pip-audit` | | cargo | cargo-audit | ✗ missing | `cargo install cargo-audit` | ``` ## Handling Missing Tools When an audit tool is not installed, the skill: 1. Reports it as a warning (not a failure) 2. Provides the install command for the missing tool 3. Continues scanning other detected ecosystems Install hints per ecosystem: | Tool | Install Command | |------|----------------| | `pip-audit` | `pip install pip-audit` | | `cargo-audit` | `cargo install cargo-audit` | | `govulncheck` | `go install golang.org/x/vuln/cmd/govulncheck@latest` | | `bundle-audit` | `gem install bundler-audit` | | `composer` | Built-in since Composer 2.4 | ## Rules - Never modify `package-lock.json`, `Cargo.lock`, or other lock files without `--fix` flag - Always report tool availability — missing tool is a finding, not a failure - Parse JSON output when available for structured data; fall back to text parsing - CRITICAL and HIGH findings should be highlighted prominently - Include advisory URLs for every CVE when available - This skill is READ-ONLY by default (no installs, no upgrades) unless `--fix` is passed - Respect `.auditrc`, `.nsprc`, or equivalent ignore files if present