Skip to main content
depscan Run OWASP Depscan for advanced Software Composition Analysis with VDR, CSAF, and license compliance. Use when scanning dependencies with deep SCA, generating VEX documents, SBOM+VDR analysis, or comprehensive license auditing.
Ir para a instalação Skills Marketplace Descubra e explore skills de IA criadas pela comunidade.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Mostrar detalhes do prompt Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/igbuend/grimbard --skill depscanO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baixar Zip Baixando... SOC
Baseado na classificação ocupacional SOC
name depscan description Run OWASP Depscan for advanced Software Composition Analysis with VDR, CSAF, and license compliance. Use when scanning dependencies with deep SCA, generating VEX documents, SBOM+VDR analysis, or comprehensive license auditing. allowed-tools ["Bash","Read","Glob","Grep"]
OWASP Depscan - Next-Generation SCA
When to Use Depscan
Ideal scenarios:
Advanced Software Composition Analysis (SCA)
Vulnerability Disclosure Report (VDR) generation
SBOM (Software Bill of Materials) creation and analysis
CSAF 2.0 VEX (Vulnerability Exploitability eXchange) documents
License compliance auditing
Risk assessment and scoring
Supply chain security analysis
Multi-format vulnerability reporting
Complements other tools:
More comprehensive than OSV-Scanner for SCA needs
Use with CDXGen for enhanced SBOM generation
Combine with code scanners (Semgrep, CodeQL) for complete coverage
Use with SARIF Issue Reporter for findings analysis
When NOT to Use
Do NOT use this skill for:
Application code vulnerability scanning (use Semgrep or CodeQL)
Secrets detection (use Gitleaks)
IaC security analysis (use KICS)
API endpoint discovery (use Noir)
Quick lightweight SCA (use OSV-Scanner instead)
Installation
pipx install owasp-depscan
pip install owasp-depscan
clone
cd
Core Workflow
1. Quick Scan
depscan --src .
depscan --src /path/to/project
depscan --src /path/to/project --reports-dir ./reports
2. SARIF Output
depscan --src /path/to/project \
--reports-dir ./reports \
--report-template sarif
depscan --src /path/to/project \
--reports-dir ./reports \
--report-template sarif,json,html
depscan --src /path/to/project \
--reports-dir ./reports \
--report-template sarif-critical
3. SBOM Generation
depscan --src /path/to/project \
--reports-dir ./reports \
--type bom
depscan --src /path/to/project \
--reports-dir ./reports \
--type sbom-vdr
depscan --bom /path/to/sbom.json --reports-dir ./reports
4. VEX Document Generation
depscan --src /path/to/project \
--reports-dir ./reports \
--vex
depscan --bom sbom.json \
--reports-dir ./reports \
--vex
Supported Package Managers Ecosystem Manifest Files Lock Files npm package.json package-lock.json, yarn.lock, pnpm-lock.yaml Python requirements.txt, setup.py, pyproject.toml Pipfile.lock, poetry.lock, pdm.lock Go go.mod go.sum Rust Cargo.toml Cargo.lock Java/Maven pom.xml - Gradle build.gradle, build.gradle.kts - Ruby Gemfile Gemfile.lock PHP composer.json composer.lock .NET packages.config, *.csproj packages.lock.json, paket.lock Dart pubspec.yaml pubspec.lock Swift Package.swift Package.resolved
Advanced Features
Risk Scoring
depscan --src /path/to/project \
--reports-dir ./reports \
--risk-audit
License Compliance
depscan --src /path/to/project \
--reports-dir ./reports \
--license-scan
depscan --src /path/to/project \
--reports-dir ./reports \
--license-scan \
--no-banner \
--fail-on-license-violation
CDXGen Integration Depscan includes CDXGen for SBOM generation:
cdxgen -r /path/to/project -o sbom.json
cdxgen -r /path/to/project -o sbom.json --evidence
cdxgen -r /monorepo -o sbom.json --multi-language
depscan --bom sbom.json --reports-dir ./reports
Specific Language Scans
depscan --src /python/project --type python --reports-dir ./reports
depscan --src /nodejs/project --type nodejs --reports-dir ./reports
depscan --src /java/project --type java --reports-dir ./reports
depscan --src /go/project --type go --reports-dir ./reports
CI/CD Integration (GitHub Actions) name: OWASP Depscan
on:
push:
branches: [main ]
pull_request:
schedule:
- cron: '0 0 * * *'
jobs:
depscan:
runs-on: ubuntu-latest
container: ghcr.io/owasp-dep-scan/dep-scan:latest
steps:
- uses: actions/checkout@v4
- name: Run Depscan
run: |
depscan --src ${{ github.workspace }} \
--reports-dir ${{ github.workspace }}/reports \
--report-template sarif,json,html \
--risk-audit \
--license-scan
- name: Upload SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: reports/depscan.sarif
category: depscan
- name: Upload Reports
if: always()
uses: actions/upload-artifact@v4
with:
name: depscan-reports
path: reports/
- name: Generate SBOM
run: |
cdxgen -r ${{ github.workspace }} \
-o reports/sbom.json \
--evidence
- name: Upload SBOM
uses: actions/upload-artifact@v4
with:
name: sbom
path: reports/sbom.json
Report Templates
Available Templates
--report-template sarif
--report-template sarif-critical
--report-template json
--report-template html
--report-template custom.j2
Custom Jinja Templates # Vulnerability Report
Project: {{ project_name }}
Scan Date: {{ scan_date }}
## Summary
Total Vulnerabilities: {{ total_vulnerabilities }}
- Critical: {{ critical_count }}
- High: {{ high_count }}
- Medium: {{ medium_count }}
- Low: {{ low_count }}
## Vulnerabilities
{% for vuln in vulnerabilities %}
### {{ vuln.id }} - {{ vuln.severity }}
**Package:** {{ vuln.package }}@{{ vuln.version }}
**Fixed in:** {{ vuln.fixed_version }}
**CVSS:** {{ vuln.cvss_score }}
{{ vuln.description }}
---
{% endfor %}
depscan --src /path/to/project \
--reports-dir ./reports \
--report-template custom-report.j2
Configuration
Config File
src = "/path/to/project"
reports_dir = "./reports"
risk_audit = true
license_scan = true
no_banner = true
report_template = ["sarif" , "json" , "html" ]
vex = true
fail_on_license_violation = false
exclude = [
"**/test/**" ,
"**/tests/**" ,
"**/node_modules/**" ,
"**/.venv/**"
]
allowed_licenses = [
"MIT" ,
"Apache-2.0" ,
"BSD-3-Clause" ,
"BSD-2-Clause" ,
"ISC"
]
depscan --config depscan.toml
Common Use Cases
1. Comprehensive SCA Audit
depscan --src /path/to/project \
--reports-dir ./audit-reports \
--report-template sarif,json,html \
--risk-audit \
--license-scan \
--vex
ls -la ./audit-reports/
2. SBOM + VDR Workflow
cdxgen -r /path/to/project -o sbom.json --evidence
depscan --bom sbom.json \
--reports-dir ./reports \
--type sbom-vdr
depscan --bom sbom.json \
--reports-dir ./reports \
--vex
3. License Compliance Check
depscan --src /path/to/project \
--license-scan \
--reports-dir ./compliance
cat ./compliance/license-report.json | jq '.licenses[] | select(.approved == false)'
depscan --src /path/to/project \
--license-scan \
--fail-on-license-violation
4. Container Image Analysis
docker export $(docker create myimage:latest) | tar -C /tmp/container-fs -xf -
depscan --src /tmp/container-fs \
--reports-dir ./container-reports \
--report-template sarif
docker run --rm -v $(pwd ):/app ghcr.io/owasp-dep-scan/dep-scan \
depscan --src /app --reports-dir /app/reports
Understanding Output
SARIF Structure
Rules : Each vulnerability typeResults : Vulnerable dependenciesProperties :
Package name and version
Vulnerability ID (CVE, GHSA, etc.)
Severity and CVSS
Fix versions
Risk score
Exploitability metrics
License information
VDR Structure Vulnerability Disclosure Report (VDR) in CycloneDX format:
{
"vulnerabilities" : [
{
"id" : "CVE-2024-12345" ,
"source" : {
"name" : "NVD" ,
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-12345"
} ,
"ratings" : [
{
"score" : 9.8 ,
"severity" : "critical" ,
"method" : "CVSSv3" ,
"vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
] ,
"affects" : [
{
"ref" : "pkg:npm/lodash@4.17.19"
}
] ,
"recommendation" : "Upgrade to version 4.17.21 or later"
}
]
}
VEX Structure {
"document" : {
"category" : "csaf_vex" ,
"title" : "Vulnerability Exploitability eXchange"
} ,
"vulnerabilities" : [
{
"cve" : "CVE-2024-12345" ,
"product_status" : {
"known_affected" : [ "pkg:npm/lodash@4.17.19" ]
} ,
"remediation" : [
{
"category" : "vendor_fix" ,
"details" : "Update to version 4.17.21"
}
]
}
]
}
Remediation Workflow
Step 1: Scan depscan --src /project \
--reports-dir ./reports \
--report-template json,sarif \
--risk-audit
Step 2: Prioritize
jq '.results[] | select(.risk_score > 7)' reports/depscan.json
jq -r '.results[] | "\(.package): \(.vulnerabilities | length) vulns"' reports/depscan.json | sort
Step 3: Fix
jq -r '.results[] | "\(.package)@\(.version) -> \(.fixed_version // "No fix available")"' reports/depscan.json
npm update
pip install --upgrade -r requirements.txt
Step 4: Verify
depscan --src /project --reports-dir ./post-fix
diff <(jq '.results[].id' reports/depscan.json | sort ) \
<(jq '.results[].id' post-fix/depscan.json | sort )
Performance Optimization
depscan --src /project --offline
depscan --src /project --report-template sarif
depscan --src /project --exclude "**/test/**,**/tests/**"
depscan --bom sbom.json --reports-dir ./reports
Integration with Other Tools
SARIF Tools
depscan --src /project --reports-dir ./reports --report-template sarif
pip install sarif-tools
sarif summary reports/depscan.sarif
sarif ls reports/depscan.sarif
sarif trends reports/*.sarif
Dependency Track
depscan --src /project \
--reports-dir ./reports \
--type sbom-vdr
curl -X POST "https://dependency-track/api/v1/bom" \
-H "X-API-Key: ${API_KEY} " \
-F "bom=@reports/bom.json"
Limitations
Performance : Slower than OSV-Scanner due to deeper analysisNetwork required : Needs internet for vulnerability database (unless offline mode)Memory usage : Large projects may require significant RAMFalse positives : Risk scoring heuristics may over/under estimatePrivate packages : Only scans public vulnerability databases
Rationalizations to Reject Shortcut Why It's Wrong "OSV-Scanner is enough" Depscan provides VDR, VEX, risk scoring, and license compliance OSV lacks "Skip VEX generation" VEX documents are critical for communicating vulnerability status to stakeholders "Disable risk audit for speed" Risk scores help prioritize fixes; speed shouldn't compromise decision quality "Ignore license violations" License compliance is legal requirement; violations can block product release "Only scan production dependencies" Dev dependencies can introduce supply chain attacks
References 