---
name: Vuln Check
slug: vuln-check
category: Quality
description: Vuln Check scans a project for known vulnerable dependencies and security anti-patterns, reports findings ordered by severity with location, impact, and remediation, and states explicitly when categories are clean.
github: "https://github.com/ccch1mneyyy/dsh-TUI/tree/main/skills/vuln-check"
language: TypeScript
stars: 1889
forks: 79
install: "npx degit https://github.com/ccch1mneyyy/dsh-TUI/tree/main/skills/vuln-check ~/.claude/skills/vuln-check"
installs_to: ~/.claude/skills/vuln-check
source_path: skills/vuln-check/SKILL.md
collection_size: 7
category_size: 1354
collection_url: "https://dirskills.com/collections/ccch1mneyyy/dsh-TUI"
added: 2026-08-18T06:59:33.621Z
last_synced: 2026-08-18T06:59:33.621Z
canonical_url: "https://dirskills.com/skills/vuln-check"
---

# Vuln Check

Vuln Check scans a project for known vulnerable dependencies and security anti-patterns, reports findings ordered by severity with location, impact, and remediation, and states explicitly when categories are clean.

**Install:**

```bash
npx degit https://github.com/ccch1mneyyy/dsh-TUI/tree/main/skills/vuln-check ~/.claude/skills/vuln-check
```

## README

# Vulnerability Check

Check the current project for security vulnerabilities: dependency advisories and code-level security anti-patterns.

## Procedure

1. **依赖审计**: inspect the lockfile/manifest (package-lock.json / pnpm-lock.yaml / requirements.txt…) for known-vulnerable versions. Use the local toolchain (npm audit / pnpm audit when available and network permits) or compare against known advisory data.
2. **代码检查**: scan for security anti-patterns with file/line evidence:
   - shell command injection (string interpolation into exec/spawn with shell:true)
   - path traversal (user input joined into paths without normalization)
   - secrets committed (API keys, tokens, private keys in the tree)
   - unsafe eval / dynamic import of user input
   - missing input validation at trust boundaries
3. Report findings ordered by severity, each with: location, CVE/advisory id when applicable, impact, and remediation (upgrade to which version, or the code change needed).
4. State explicitly when the project is clean in a category.

## Constraints

- Distinguish "verified vulnerable" from "needs verification" — never overstate.
- Do not modify code during the check.