Skill Store 33

Sca Audit

Scan project dependencies for known vulnerabilities (CVEs).

by owasp · CC-BY-4.0

The skill

Scan project dependencies for known vulnerabilities (CVEs). Use when reviewing dependency files (package.json, requirements.txt, go.mod, pom.xml, Gemfile, Cargo.toml, etc.), triaging Dependabot/Renovate alerts, or performing pre-deployment security checks.

Software Composition Analysis Audit

Scan dependencies for known CVEs by following the full procedure in plays/sca-audit.md.

Steps

  1. Identify Dependency Manifests — Scan for all dependency files and lockfiles across ecosystems (Node.js, Python, Go, Java, Ruby, Rust, .NET, PHP). Prefer lockfiles for exact resolved versions.

  2. Run Vulnerability Scan — Use available tools in preference order:

    • osv-scanner --lockfile=<path> --format=json (recommended, multi-ecosystem)
    • npm audit --json (Node.js)
    • pip-audit -r requirements.txt --format=json (Python)
    • govulncheck ./... (Go)
    • trivy fs --format json --scanners vuln <path> (multi-ecosystem)
    • If no scanner is installed, stop and ask the user to install one (e.g., brew install osv-scanner). Manual analysis is not viable — even small projects have 50+ dependencies. For individual package triage, point the user to OSV.dev.

  3. Analyze Results — For each vulnerability: determine reachability (is the vulnerable code path used?), check exploitability context (deployment matters), and identify fix availability (patch vs major version bump).

  4. Dependency Health — Beyond CVEs, flag unmaintained packages (2+ years inactive), typosquatting risks, license concerns, and version pinning issues.

Output

Scan summary (ecosystems, dependency count, scanner used), findings sorted by severity using templates/finding.md, condensed table for medium/low, dependency health flags, and exact remediation commands.

OWASP References

  • A06:2021: Vulnerable and Outdated Components
  • OWASP Dependency-Check
  • OWASP SCVS

Use this skill

Connect your agent to the Skill Store MCP server and ask for it by ref: owasp/sca-audit-89463647438.

Download SKILL.md · Markdown version

Details

Publisher
owasp
Category
Security › Application security
License
CC-BY-4.0
Updated
2026-10-15

References

More from owasp

  • Multi Agentic Threat Model Comprehensive threat modeling for multi-agent systems using CSA MAESTRO 7-layer framework and OWA…
  • Agent Security Audit Audit AI agent configurations for security risks — excessive permissions, prompt injection surfac…
  • Agentic Ai Risk Assess Assess agentic AI applications against the OWASP Top 10 for Agentic Applications 2026.
  • Ai Security Verification Comprehensive AI security verification using OWASP AI Security Verification Standard (AISVS) fram…

Related skills

  • Dependency Scan Detect CVEs and security issues in project dependencies.
  • Dependency Auditor Scan project dependencies for vulnerabilities, license issues, and upgrade opportunities across P…
  • Ghost Scan Deps Ghost Security - Software Composition Analysis (SCA) scanner.
  • Dependency Check Scan project dependencies for known vulnerabilities and CVEs.
  • Dependency Audit Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs,…