---
name: CVE Scan
slug: cve-scan
category: Quality
description: CVE Scan detects project ecosystems and runs native audit tools to report known dependency vulnerabilities. Use it to check npm, pip, Cargo, Go, Composer, Bundler, or Dart projects and optionally auto-fix supported issues.
github: "https://github.com/softspark/ai-toolkit/tree/main/app/skills/cve-scan"
language: Python
stars: 170
forks: 20
install: "npx degit https://github.com/softspark/ai-toolkit/tree/main/app/skills/cve-scan ~/.claude/skills/cve-scan"
installs_to: ~/.claude/skills/cve-scan
source_path: app/skills/cve-scan/SKILL.md
collection_size: 25
category_size: 1897
collection_url: "https://dirskills.com/collections/softspark/ai-toolkit"
added: 2026-09-08T05:33:52.104Z
last_synced: 2026-09-08T05:33:52.104Z
canonical_url: "https://dirskills.com/skills/cve-scan"
---

# CVE Scan

CVE Scan detects project ecosystems and runs native audit tools to report known dependency vulnerabilities. Use it to check npm, pip, Cargo, Go, Composer, Bundler, or Dart projects and optionally auto-fix supported issues.

**Install:**

```bash
npx degit https://github.com/softspark/ai-toolkit/tree/main/app/skills/cve-scan ~/.claude/skills/cve-scan
```

## README

# /cve-scan - Dependency CVE Scanner

$ARGUMENTS

Detect project ecosystems and scan dependencies for known vulnerabilities using native audit tools. Zero external dependencies — uses tools already installed in the project environment.

## Usage

```
/cve-scan                        # Auto-detect all ecosystems, scan all
/cve-scan --ecosystem npm        # Force specific ecosystem
/cve-scan --fix                  # Auto-fix where possible (npm audit fix, etc.)
/cve-scan --json                 # Machine-readable JSON output
```

## What This Command Does

1. **Detect** package managers by lock/manifest files in the project
2. **Run** the native audit command for each detected ecosystem
3. **Parse** results into a unified severity-based report
4. **Report** CVE IDs, affected packages, installed vs fixed versions, advisory links
5. **Fix** automatically when `--fix` is passed (where the tool supports it)

## Ecosystem Detection & Commands

| Manifest File | Lock File | Ecosystem | Audit Command | CVE Database |
|---------------|-----------|-----------|---------------|--------------|
| `package.json` | `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` | npm/yarn/pnpm | `npm audit --json` / `yarn audit --json` / `pnpm audit --json` | GitHub Advisory DB |
| `requirements.txt` / `pyproject.toml` / `setup.py` | `requirements.txt` | pip | `pip-audit --format=json` | OSV / PyPI Advisory |
| `composer.json` | `composer.lock` | composer | `composer audit --format=json` | Packagist / FriendsOfPHP |
| `Cargo.toml` | `Cargo.lock` | cargo | `cargo audit --json` | RustSec Advisory DB |
| `go.mod` | `go.sum` | go | `govulncheck ./...` | Go Vulnerability DB |
| `Gemfile` | `Gemfile.lock` | bundler | `bundle-audit check` | Ruby Advisory DB |
| `pubspec.yaml` | `pubspec.lock` | dart/flutter | `dart pub outdated --json` | pub.dev |

## Steps

1. **Detect ecosystems**: Glob for manifest/lock files at project root and common subdirectories
2. **Check tool availability**: Verify audit tool is installed for each detected ecosystem
3. **Run audit**: Execute native audit command, capture JSON output where available
4. **Parse results**: Extract CVE ID, package name, installed version, fixed version, severity, advisory URL
5. **Unified report**: Merge all ecosystems into single report sorted by severity
6. **Fix mode**: If `--fix` passed, run `npm audit fix`, `pip-audit --fix`, `cargo audit fix` etc.
7. **Exit code**: Non-zero if any CRITICAL or HIGH vulnerabilities found

## Detection Script

Run the bundled detection script to quickly identify ecosystems and tool availability:

```bash
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py
```

Options:
```bash
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --json      # JSON output
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --fix        # Auto-fix mode
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --ecosystem npm  # Specific ecosystem
```

## Output Format

```markdown
## CVE Scan Report

### Ecosystems Detected
- npm (package-lock.json) — `npm audit` available ✓
- pip (requirements.txt) — `pip-audit` not installed ⚠️

### Summary
| Severity | Count |
|----------|-------|
| CRITICAL | 1 |
| HIGH | 3 |
| MEDIUM | 5 |
| LOW | 2 |

### Findings

#### [CRITICAL] lodash@4.17.20 (npm)
- **CVE**: CVE-2021-23337
- **Title**: Prototype Pollution
- **Fixed in**: 4.17.21
- **Advisory**: https://github.com/advisories/GHSA-35jh-r3h4-6jhm

#### [HIGH] django@3.2.0 (pip)
- **CVE**: CVE-2023-36053
- **Title**: Potential ReDoS in EmailValidator
- **Fixed in**: 3.2.20
- **Advisory**: https://osv.dev/vulnerability/PYSEC-2023-100

### Tool Availability
| Ecosystem | Tool | Status | Install Hint |
|-----------|------|--------|--------------|
| npm | npm audit | ✓ installed | — |
| pip | pip-audit | ✗ missing | `pip install pip-audit` |
| cargo | cargo-audit | ✗ missing | `cargo install cargo-audit` |
```

## Handling Missing Tools

When an audit tool is not installed, the skill:
1. Reports it as a warning (not a failure)
2. Provides the install command for the missing tool
3. Continues scanning other detected ecosystems

Install hints per ecosystem:

| Tool | Install Command |
|------|----------------|
| `pip-audit` | `pip install pip-audit` |
| `cargo-audit` | `cargo install cargo-audit` |
| `govulncheck` | `go install golang.org/x/vuln/cmd/govulncheck@latest` |
| `bundle-audit` | `gem install bundler-audit` |
| `composer` | Built-in since Composer 2.4 |

## Rules

- Never modify `package-lock.json`, `Cargo.lock`, or other lock files without `--fix` flag
- Always report tool availability — missing tool is a finding, not a failure
- Parse JSON output when available for structured data; fall back to text parsing
- CRITICAL and HIGH findings should be highlighted prominently
- Include advisory URLs for every CVE when available
- This skill is READ-ONLY by default (no installs, no upgrades) unless `--fix` is passed
- Respect `.auditrc`, `.nsprc`, or equivalent ignore files if present