dependency-cve-check

Files (8)

• SKILL.md
• cve-policy.md · references/
• dotnet.md · references/
• kev-correlation.md · references/
• maven-gradle.md · references/
• npm.md · references/
• osv.md · references/
• python.md · references/

SKILL.md (first lines)

# Dependency CVE Check

- [npm](references/npm.md)
- [Maven / Gradle](references/maven-gradle.md)
- [Python](references/python.md)
- [.NET](references/dotnet.md)
- [OSV](references/osv.md)
- [KEV Correlation](references/kev-correlation.md)
- [CVE Age/Severity Policy](references/cve-policy.md)

## Process

1. Use `scripts/discovery/detect_dependencies.py` to locate manifests/lockfiles, then `scripts/scanners/run_osv_scanner.py` to identify CVEs against them — see the ecosystem-specific reference above for how to resolve the *actually installed* version from each ecosystem's manifest/lockfile pair.
2. Correlate each CVE per [osv.md](references/osv.md) "Correlation Requirements" — a match is a `CANDIDATE`, not evidence the vulnerable code path is reachable in this application.
3. Run `scripts/scanners/check_kev.py` to tag each finding with CISA KEV (Known Exploited Vulnerabilities) status — see [kev-correlation.md](references/kev-correlation.md) for the full methodology and why this changes *priority*, not severity.
4. Run `scripts/scanners/check_cve_policy.py` to flag CVEs meeting a configurable severity/recency policy, independent of confirmed KEV status — see [cve-policy.md](references/cve-policy.md).

## When to Use

Whenever manifest/lockfile changes are in scope, or as part of `05_static_security_scanning` for a full-repository review — always in combination with `dependency-cve-check`'s always-run status per [workflow/routing_rules.yaml](../../workflow/routing_rules.yaml).

## Output

A candidate finding conforming to [finding.schema.json](../../schemas/finding.schema.json), with `kev` populated once `check_kev.py` has run and `cve_policy` populated once `check_cve_policy.py` has run.

From felipegiannetti/claude-security-agents, MIT.

More from felipegiannetti/claude-security-agents