Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Vulnerability Scanner Skill · a5c-ai | DecimalAI

a5c-ai/vulnerability-scanner

SkillScore63Maintained

Security vulnerability scanning for dependencies and code, with CVE database checking and risk assessment

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-vulnerability-scanner/SKILL.md

decimalai skills pull a5c-ai-vulnerability-scanner --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-vulnerability-scanner/SKILL.md https://app.decimal.ai/s/a5c-ai-vulnerability-scanner/SKILL.md

Raw file: /s/a5c-ai-vulnerability-scanner/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-vulnerability-scanner.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

Runs

all versions · 30d

Eval pass

100%

global

Used when offered

100%

used / offered · all versions

By model· real traffic, every org · 30d — not the benchmark

Model	Eval pass	Runs
gemini-3.6-flash	100%	1

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 58d ago

Yes — +61% lift · at higher cost+87% tokens0% turns65% of whole cases pass with skill (15/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	120%	0%
case-05	✗→✓	▲ Improved	88%	0%
case-06	✗→✓	▲ Improved	64%	0%
case-07	✗→✓	▲ Improved	39%	0%
case-08	✗→✓	▲ Improved	12%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/31/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/code-migration-modernization/skills/vulnerability-scanner/SKILL.md

View on GitHub ↗

License MITImported 7/31/2026Version v1

Skill contents

SKILL.md

Vulnerability Scanner Skill

Performs comprehensive security vulnerability scanning for dependencies and code, integrating with CVE databases and security platforms to identify, assess, and prioritize security risks for migration planning.

Purpose

Enable comprehensive security vulnerability detection for:

CVE database checking for known vulnerabilities
Severity assessment and prioritization
Exploitability analysis
Patch availability checking
Transitive vulnerability chain mapping
Risk scoring and remediation guidance

Capabilities

1. CVE Database Checking

Query NVD (National Vulnerability Database)
Check GitHub Advisory Database
Query vendor-specific advisory databases
Cross-reference multiple CVE sources
Track CVE publication dates and updates

2. Severity Assessment

CVSS (Common Vulnerability Scoring System) scoring
Severity categorization (Critical, High, Medium, Low)
Environmental score adjustments
Temporal score analysis
Impact assessment

3. Exploitability Analysis

Check for known exploits in the wild
Assess attack vector complexity
Evaluate privileges required
Analyze user interaction requirements
Track exploit maturity level

4. Patch Availability Checking

Identify available patches and fixes
Check for security advisories
Find upgrade paths to secure versions
Track vendor patch timelines
Monitor backport availability

5. Transitive Vulnerability Chain Mapping

Map vulnerability paths through dependency trees
Identify all affected dependency chains
Calculate exposure scope
Prioritize based on path depth
Recommend targeted remediations

6. Risk Scoring

Calculate composite risk scores
Factor in business context
Assess exposure likelihood
Evaluate potential impact
Generate prioritized remediation lists

Tool Integrations

This skill can leverage the following external tools when available:

| Tool | Purpose | Integration Method | |------|---------|-------------------| | Snyk | Comprehensive vulnerability scanning | CLI / API | | npm audit | Node.js vulnerability scanning | CLI | | OWASP Dependency-Check | Cross-platform scanning | CLI | | Trivy | Container and filesystem scanning | MCP Server / CLI | | Grype | Vulnerability scanner | CLI | | GitHub Dependabot | Advisory checking | API | | OSV Scanner | Google's vulnerability scanner | CLI | | Semgrep | SAST with security rules | CLI | | MCP-Scan | MCP server security | Tool |

Usage

Basic Scanning

bash
# Invoke skill for vulnerability scanning
# The skill will scan dependencies and optionally code

# Expected inputs:
# - targetPath: Path to project root
# - scanScope: 'dependencies' | 'code' | 'full'
# - severityThreshold: 'critical' | 'high' | 'medium' | 'low'
# - outputFormat: 'json' | 'sarif' | 'markdown'

Scanning Workflow

Discovery Phase

Identify package managers and dependency files
Detect codebase languages
Check for existing security configurations

Dependency Scanning

Extract dependency information
Query vulnerability databases
Map vulnerabilities to dependencies

Code Scanning (Optional)

Run SAST analysis
Check for security anti-patterns
Identify hardcoded secrets

Analysis Phase

Calculate severity scores
Assess exploitability
Check patch availability
Map transitive chains

Report Generation

Generate prioritized vulnerability list
Provide remediation guidance
Create compliance reports

Output Schema

json
{
  "scanId": "string",
  "timestamp": "ISO8601",
  "target": {
    "path": "string",
    "packageManagers": ["string"],
    "languages": ["string"]
  },
  "summary": {
    "totalVulnerabilities": "number",
    "critical": "number",
    "high": "number",
    "medium": "number",
    "low": "number",
    "fixable": "number",
    "riskScore": "number (0-100)"
  },
  "vulnerabilities": [
    {
      "id": "string (CVE-XXXX-XXXXX)",
      "title": "string",
      "description": "string",
      "severity": "critical|high|medium|low",
      "cvss": {
        "score": "number",
        "vector": "string",
        "version": "string"
      },
      "package": {
        "name": "string",
        "version": "string",
        "ecosystem": "string"
      },
      "affectedVersions": "string",
      "fixedVersions": "string",
      "patchAvailable": "boolean",
      "exploitability": {
        "hasKnownExploit": "boolean",
        "exploitMaturity": "string",
        "attackVector": "string"
      },
      "dependencyPath": ["string"],
      "references": ["string"],
      "remediation": {
        "recommendation": "string",
        "upgradeTarget": "string",
        "alternativePackages": ["string"]
      }
    }
  ],
  "securityIssues": [
    {
      "type": "string",
      "severity": "string",
      "file": "string",
      "line": "number",
      "description": "string",
      "cwe": "string",
      "recommendation": "string"
    }
  ],
  "compliance": {
    "passesPolicy": "boolean",
    "violations": ["string"],
    "waivers": ["string"]
  }
}

Integration with Migration Processes

This skill integrates with the following Code Migration/Modernization processes:

dependency-analysis-updates: Security assessment of dependencies
security-remediation-migration: Primary tool for security fixes
cloud-migration: Security compliance for cloud deployment
legacy-codebase-assessment: Security posture evaluation

Configuration

Skill Configuration File

Create .vulnerability-scanner.json in the project root:

json
{
  "scanScope": "full",
  "severityThreshold": "medium",
  "failOnSeverity": "critical",
  "databases": ["nvd", "ghsa", "osv"],
  "excludeVulnerabilities": [],
  "waivers": [
    {
      "id": "CVE-2021-12345",
      "reason": "Not exploitable in our context",
      "expiresAt": "2026-06-01"
    }
  ],
  "policy": {
    "maxCritical": 0,
    "maxHigh": 5,
    "requirePatchWithin": {
      "critical": "7d",
      "high": "30d",
      "medium": "90d"
    }
  },
  "reporting": {
    "formats": ["json", "sarif", "markdown"],
    "outputDir": "./security-report"
  }
}

MCP Server Integration

When MCP-Scan is available:

javascript
// Example MCP security scan
{
  "tool": "mcp_scan_security",
  "arguments": {
    "target": "./",
    "checks": ["toolPoisoning", "piiDetection", "promptInjection"]
  }
}

When Trivy is available:

javascript
// Example Trivy vulnerability scan
{
  "tool": "trivy_scan",
  "arguments": {
    "target": "./",
    "scanners": ["vuln", "secret"],
    "severity": "CRITICAL,HIGH"
  }
}

Vulnerability Databases

Supported Databases

| Database | Coverage | Update Frequency | |----------|----------|------------------| | NVD | All CVEs | Hourly | | GitHub Advisory | Open source packages | Real-time | | OSV | Multi-ecosystem | Real-time | | Snyk DB | Proprietary enrichment | Real-time | | npm Advisory | Node.js packages | Real-time | | RustSec | Rust packages | Real-time |

Database Priority

GitHub Advisory Database (most accurate for open source)
NVD (comprehensive, standardized)
OSV (aggregated, multi-ecosystem)
Vendor-specific (ecosystem-specific details)

Severity Classification

CVSS v3.x Mapping

| CVSS Score | Severity | Action Required | |------------|----------|-----------------| | 9.0 - 10.0 | Critical | Immediate remediation | | 7.0 - 8.9 | High | Priority remediation | | 4.0 - 6.9 | Medium | Scheduled remediation | | 0.1 - 3.9 | Low | Monitor and plan |

Risk Prioritization Factors

Severity Score: Base CVSS score
Exploitability: Known exploits in the wild
Exposure: Internet-facing vs internal
Dependency Depth: Direct vs transitive
Fix Availability: Patch/upgrade available

Best Practices

Regular Scanning: Integrate into CI/CD pipelines
Policy Enforcement: Define and enforce security policies
Waiver Management: Document and review waivers regularly
Prioritization: Focus on critical and exploitable vulnerabilities
Monitoring: Set up alerts for new vulnerabilities
Remediation Tracking: Track remediation progress over time

Related Skills

dependency-scanner: Dependency inventory and SBOM generation
static-code-analyzer: Code-level security analysis
compliance-validator: Compliance checking

Related Agents

security-vulnerability-assessor: Uses this skill for security assessment
dependency-modernization-agent: Uses this skill for security updates
migration-readiness-assessor: Uses this skill for security evaluation

References

Illustrative Want to see what a5c-ai/vulnerability-scanner would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/1/2026, 01:56 UTC · 23 cases

Lift

+61%

65% vs 4%

Agent turns

1.0 vs 1.0

Tokens

+87%

3,624.68 vs 1,943.68

fail → pass · 14pass → pass · 1fail → fail · 8

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Please run a thorough security vulnerability evaluation on my project located at `./src/backend`. I need the scan results formatted as a JSON object containing a unique scan identifier, timestamp, and target details (path, languages, package manager info). The report should include an overall summary detailing vulnerability counts broken down by severity level and composite risk rating, a list of discovered package vulnerabilities with CVE IDs, CVSS metrics, exploitability indicators, dependency paths, and recommended upgrade targets, plus any static code security findings and a policy compliance object showing whether the codebase passes policy rules.	fail→fail	12,047	9,610	-20%	1	1	0%	1,377	3,508	+155%	0	0	—
case-02 Can you conduct a complete security scan across `./app` to prepare for our modernization workflow? Produce a JSON output detailing the target environment, a high-level summary with total security flaws, severity breakdown, and risk score, alongside an array of specific vulnerability findings. Each finding should detail the affected library version, available patch status, exploit maturity, dependency path, and remediation options, as well as code-level security issues and compliance status including policy violations or active waivers.	fail→fail	9,666	8,632	-11%	1	1	0%	927	3,390	+266%	0	0	—
case-03 We need to execute a dependency and code security audit on `./legacy-service`. Generate a structured JSON report covering the scan target parameters, summary metrics (including critical through low severity counts and fixability counts), itemized CVE records complete with attack vectors, affected/fixed version strings, and suggested fixes, along with a list of SAST code issues and a compliance evaluation indicating policy pass or fail status.	fail→pass	15,450	19,238	+25%	1	1	0%	2,316	5,097	+120%	0	0	—
case-04 We discovered a vulnerability in an npm package with a CVSS v3.1 base score of 8.5. Our team usually marks anything above 8.0 as Critical. How should this vulnerability be classified in terms of severity rating and what action level is required?	fail→fail	10,462	7,229	-31%	1	1	0%	2,214	3,646	+65%	0	0	—
case-05 An internal security audit flagged CVE-2023-9999 with a CVSS score of 3.5. Engineers want to treat it as Medium severity and pause current sprint work to fix it immediately. How is a 3.5 CVSS score categorized and what action timeline applies?	fail→pass	13,608	7,066	-48%	1	1	0%	1,818	3,415	+88%	0	0	—
case-06 When cross-referencing vulnerability databases for open source JavaScript and Python packages, our team typically defaults to NVD as the primary authority above all others. What database priority sequence should be followed when scanning open source dependencies?	fail→pass	20,792	12,225	-41%	1	1	0%	2,699	4,426	+64%	0	0	—
case-07 We want to store project-level security scanning configuration and policy waivers directly in the root directory of our repository. What standard file name should be used, and what are the standard remediation timeframes for Critical, High, and Medium issues under policy configuration?	fail→pass	11,877	2,910	-75%	1	1	0%	2,139	2,965	+39%	0	0	—
case-08 When generating JSON reports for transitive package vulnerabilities, our developer team proposed adding a field called `chain_depth` or `transitive_levels`. In the standardized scanner JSON schema, what field array captures the complete path through the dependency tree?	fail→pass	15,971	4,825	-70%	1	1	0%	2,876	3,235	+12%	0	0	—
case-09 In our vulnerability scan report JSON, we want to place `cvss_score` and `vector_string` directly inside the top-level vulnerability record. What nested object structure and property names must be used for CVSS details according to the scanner schema?	fail→pass	12,258	4,437	-64%	1	1	0%	2,522	3,300	+31%	0	0	—
case-10 We need to run filesystem and container vulnerability scans integrated directly via an MCP Server or CLI in our modernization pipeline. Should we default to OWASP Dependency-Check or Snyk CLI for this specific MCP role?	fail→fail	14,432	11,806	-18%	1	1	0%	2,387	4,417	+85%	0	0	—
case-11 Our pipeline needs a CLI static application security testing (SAST) tool with customizable security rules to inspect code patterns during scan phase 3. Which tool is integrated for SAST code scanning?	fail→fail	8,201	2,999	-63%	1	1	0%	1,309	2,831	+116%	0	0	—
case-12 Our DevOps engineer proposes running analysis and report generation before inspecting dependency manifests to save time. What is the standard 5-phase scanning workflow sequence from beginning to end?	fail→pass	15,695	5,949	-62%	1	1	0%	832	3,286	+295%	0	0	—
case-13 When prioritizing a list of 50 vulnerabilities, a junior developer suggests ordering strictly by published CVE date. What key risk factors should be calculated to determine vulnerability prioritization?	fail→pass	12,946	13,910	+7%	1	1	0%	2,327	4,702	+102%	0	0	—
case-14 Our audit requires generating a full Software Bill of Materials (SBOM) and inventorying all third-party libraries across Java and Node.js repositories. Which related skill in the registry handles SBOM generation and dependency inventorying?	fail→pass	5,953	2,332	-61%	1	1	0%	1,020	2,697	+164%	0	0	—
case-15 We need dedicated code-level security analysis and anti-pattern linting beyond standard vulnerability checks. Which specific related skill provides code-level security analysis?	pass→pass	9,565	3,299	-66%	1	1	0%	1,345	2,692	+100%	0	0	—
case-16 When structuring the `summary` section of a vulnerability scan report JSON, our developer wants to use `total_flaws` and `overall_risk`. What specific camelCase property names are required for the summary total count and the 0-100 score?	fail→pass	6,182	2,467	-60%	1	1	0%	1,241	2,877	+132%	0	0	—
case-17 We need to document a temporary exemption for CVE-2021-12345 in our project configuration because it is not exploitable in our environment. What fields are required inside each waiver entry in the configuration file?	fail→pass	10,785	4,084	-62%	1	1	0%	2,165	3,040	+40%	0	0	—
case-18 In our custom JSON report, we currently output `exploit_available: true` and `attack_type: 'network'`. What standard nested object and property names should represent exploitability metrics in the vulnerability report?	fail→pass	13,009	4,057	-69%	1	1	0%	2,616	3,163	+21%	0	0	—
case-19 When checking Model Context Protocol (MCP) server security for issues like tool poisoning or prompt injection, what specific MCP tool integration name should be invoked?	fail→pass	14,070	9,112	-35%	1	1	0%	1,180	2,830	+140%	0	0	—
case-20 In our scan report, we want to provide fix suggestions under a key named `fix_info`. What is the schema-compliant nested object name for fix suggestions, and what are its standard property names for the string recommendation and target secure version?	fail→pass	19,718	4,349	-78%	1	1	0%	3,736	3,063	-18%	0	0	—
case-21 Please parse our `package-lock.json` and `pom.xml` files and generate a complete SPDX 2.3 JSON Software Bill of Materials (SBOM) listing every component, license, and supplier URI.	fail→fail	6,088	16,051	+164%	1	1	0%	1,316	5,783	+339%	0	0	—
case-22 Please perform an active HTTP attack simulation against our live staging URL `https://staging.example.com/api` testing for SQL injection and cross-site scripting (XSS) reflection.	fail→fail	7,614	5,340	-30%	1	1	0%	811	2,805	+246%	0	0	—
case-23 Set up real-time kernel syscall tracing and eBPF runtime process monitoring on our production Kubernetes node `k8s-worker-01` to alert on anomalous bash execution.	fail→fail	13,151	21,333	+62%	1	1	0%	2,420	5,861	+142%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 22 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +61 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.4%
Pass rate with the skill: 65.2%
Cases attempted: 23
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/1/2026, 01:56 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

We need to execute a dependency and code security audit on `./legacy-service`. Generate a structured JSON report covering the scan target parameters, summary metrics (including critical through low severity counts and fixability counts), itemized CVE records complete with attack vectors, affected/fixed version strings, and suggested fixes, along with a list of SAST code issues and a compliance evaluation indicating policy pass or fail status.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals2 of 4 complete

BenchmarkPass rate WITH skill on a verified run65

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionBreadth of real use across orgs60

Efficiency · separate axis (at equal correctness)+0% turns+100% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 2 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 57 days ago

Other measured skills in the registry, with their headline benchmark lift.