vm-dependency-scanner

# Dependency Scanner Skill

Scans project dependencies for known vulnerabilities across multiple package managers.

## When to Use This Skill

- Scanning for vulnerable dependencies before deployment
- Supply chain security assessment
- Identifying outdated packages with security issues
- Pre-commit dependency validation
- CI/CD security gate for dependency checks
- Audit preparation for third-party components

## Unitary Function

**ONE RESPONSIBILITY:** Scan dependencies for known CVE vulnerabilities

**NOT RESPONSIBLE FOR:**
- Source code vulnerability scanning (see vm-vulnerability-scanner)
- Codebase structure analysis (see vm-codebase-analyzer)
- License compliance checking (separate concern)
- Dependency updates or fixes (reporting only)
- Runtime dependency analysis (static analysis only)

## Input

```json
{
  "repository_path": "/path/to/codebase",
  "package_managers": ["npm", "pip", "maven"],
  "severity_threshold": "medium",
  "include_dev_dependencies": false,
  "use_cache": true
}
```

**Parameters:**
- **repository_path** (required): Path to codebase root
- **package_managers** (optional): Auto-detected if not provided
- **severity_threshold** (optional): `critical` | `high` | `medium` | `low` (default: `medium`)
- **include_dev_dependencies** (optional): Scan dev/test deps (default: `false`)
- **use_cache** (optional): Use local CVE cache for speed (default: `true`)

## Output

Dependency vulnerability report (JSON format):

```json
{
  "scan_summary": {
    "timestamp": "2026-01-13T10:30:00Z",
    "total_dependencies": 357,
    "vulnerable_dependencies": 8,
    "critical": 1,
    "high": 3,
    "medium": 3,
    "low": 1,
    "scan_duration": "12s"
  },
  "package_managers": [
    {
      "type": "npm",
      "file": "package.json",
      "total_dependencies": 312,
      "vulnerable": 5
    },
    {
      "type": "pip",
      "file": "requirements.txt",
      "total_dependencies": 45,
      "vulnerable": 3
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-12345",
      "package": "express",
      "installed_version": "4.16.0",
      "patched_version": "4.19.2",
      "severity": "critical",
      "cvss_score": 9.8,
      "description": "Remote code execution via prototype pollution",
      "cwe": "CWE-1321",
      "published_date": "2024-11-15",
      "references": [
        "https://nvd.nist.gov/vuln/detail/CVE-2024-12345",
        "https://github.com/advisories/GHSA-xxxx-yyyy-zzzz"
      ],
      "remediation": "Upgrade to express@4.19.2 or later",
      "exploit_available": true,
      "epss_score": 0.89
    }
  ],
  "dependency_tree": {
    "direct_dependencies": 45,
    "transitive_dependencies": 312,
    "vulnerable_direct": 2,
    "vulnerable_transitive": 6
  }
}
```

## Supported Package Managers

### JavaScript/Node.js
- **npm:** `package.json`, `package-lock.json`
- **yarn:** `yarn.lock`
- **pnpm:** `pnpm-lock.yaml`
- **Tool:** `npm audit`, `yarn audit`, or OSV API

### Python
- **pip:** `requirements.txt`