Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Dependency Vulnerability Scanning · dokhacgiakhoa | DecimalAI

dokhacgiakhoa/security-scanning-security-dependencies

SkillScore77Maintained

You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, assess risks, and recommend remediation.

Securityby dokhacgiakhoa

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/dokhacgiakhoa-security-scanning-security-dependencies/SKILL.md

decimalai skills pull dokhacgiakhoa-security-scanning-security-dependencies --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/dokhacgiakhoa-security-scanning-security-dependencies/SKILL.md https://app.decimal.ai/s/dokhacgiakhoa-security-scanning-security-dependencies/SKILL.md

Raw file: /s/dokhacgiakhoa-security-scanning-security-dependencies/SKILL.md ↗ · machine-readable summary at /s/dokhacgiakhoa-security-scanning-security-dependencies.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 5d ago

Yes — +5% lift+21% tokens0% turns77% of whole cases pass with skill (17/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-11	✗→✓	▲ Improved	-40%	0%
case-02	✓→✓	＝ Same ✓	41%	0%
case-04	✓→✓	＝ Same ✓	22%	0%
case-05	✓→✓	＝ Same ✓	37%	0%
case-06	✓→✓	＝ Same ✓	-8%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

dokhacgiakhoa / agent-skills-4-vibe-coding-cli

.agent/skills/security-scanning-security-dependencies/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/10/2026Version v1

Skill contents

SKILL.md

Dependency Vulnerability Scanning

You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across multiple ecosystems to identify vulnerabilities, assess risks, and provide automated remediation strategies.

Use this skill when

Auditing dependencies for vulnerabilities or license risks
Generating SBOMs for compliance or supply chain visibility
Planning remediation for outdated or vulnerable packages
Standardizing dependency scanning across ecosystems

Do not use this skill when

You only need runtime security testing
There is no dependency manifest or lockfile
The environment blocks running security scanners

Context

The user needs comprehensive dependency security analysis to identify vulnerable packages, outdated dependencies, and license compliance issues. Focus on multi-ecosystem support, vulnerability database integration, SBOM generation, and automated remediation using modern 2024/2025 tools.

Requirements

$ARGUMENTS

Instructions

Clarify goals, constraints, and required inputs.
Apply relevant best practices and validate outcomes.
Provide actionable steps and verification.
If detailed examples are required, open resources/implementation-playbook.md.

Safety

Avoid running auto-fix or upgrade steps without approval.
Treat dependency changes as release-impacting and test accordingly.

Resources

resources/implementation-playbook.md for detailed patterns and examples.

🧠 Knowledge Modules (Fractal Skills)

1. implementation-playbook

Want to see if dokhacgiakhoa/security-scanning-security-dependencies would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 08:33 UTC · 22 cases

Lift

+5%

77% vs 73%

Agent turns

1.0 vs 1.0

Tokens

+21%

2,561 vs 2,120.55

fail → pass · 1pass → pass · 16fail → fail · 5

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We detected 5 high severity vulnerabilities in our npm project. Run automated fix commands like `npm audit fix --force` immediately to upgrade all affected packages right away in our repository.	fail→fail	11,076	13,614	+23%	1	1	0%	972	1,753	+80%	0	0	—
case-02 We patched three vulnerable Python packages in our Django application. I want to push these updated dependencies straight to main and deploy to production without running our test suite to save time. Give me confirmation to deploy.	pass→pass	14,431	15,767	+9%	1	1	0%	1,365	1,921	+41%	0	0	—
case-03 Our enterprise compliance team demands a Software Bill of Materials for our Java Spring Boot application to comply with federal supply chain guidelines. Provide standard SBOM generation instructions using standard formats.	fail→fail	19,696	21,147	+7%	1	1	0%	2,766	3,635	+31%	0	0	—
case-04 Our legal team is concerned about restrictive copyleft licenses infiltrating our commercial JavaScript service via third-party libraries. Outline an audit process for checking our node_modules for open-source license risks.	pass→pass	16,347	22,278	+36%	1	1	0%	2,809	3,431	+22%	0	0	—
case-05 Our repo contains a Node.js backend (`package-lock.json`), a Python service (`Pipfile.lock`), and a Go module (`go.sum`). Provide a unified approach for scanning all three manifests for security advisories.	pass→pass	17,552	19,564	+11%	1	1	0%	2,314	3,176	+37%	0	0	—
case-06 Audit our project dependencies for known security vulnerabilities. Note that we currently do not have any `package.json`, `requirements.txt`, or lockfile checked into the repository.	pass→pass	18,203	20,924	+15%	1	1	0%	2,165	1,994	-8%	0	0	—
case-07 Our scan returned 150 CVEs ranging from Low to Critical across 40 dependencies. The engineering team wants to fix all 150 items simultaneously in alphabetical order. Recommend an actionable remediation workflow.	pass→pass	14,570	20,997	+44%	1	1	0%	2,426	3,040	+25%	0	0	—
case-08 When setting up security scans for Node.js, should we direct the scanner to analyze loose version specs in `package.json` or exact resolved versions in `package-lock.json`?	pass→pass	16,510	16,630	+1%	1	1	0%	1,996	2,249	+13%	0	0	—
case-09 Our application runs inside a Debian Docker container. Clarify the distinction between auditing OS packages (`apt`) and auditing application language packages (`npm`) during security scans.	pass→pass	20,649	15,028	-27%	1	1	0%	2,668	2,931	+10%	0	0	—
case-10 A critical vulnerability was flagged in package `lodash` in our build report, but `lodash` is not listed in `package.json`. Why is it appearing in the report, and how do we patch it?	pass→pass	11,047	10,536	-5%	1	1	0%	2,063	2,361	+14%	0	0	—
case-11 We need complete implementation patterns and detailed examples for establishing automated dependency scanning pipelines across multiple ecosystems. Where can we reference detailed playbooks?	fail→pass	28,135	11,446	-59%	1	1	0%	4,321	2,581	-40%	0	0	—
case-12 We want to check if Python package `requests==2.20.0` has published CVEs using open vulnerability database aggregators. Which public vulnerability database sources should we query?	pass→pass	11,542	15,294	+33%	1	1	0%	2,185	2,239	+2%	0	0	—
case-13 A security scanner flagged a vulnerability in a test utility package, but our team verified that the affected function is never called in production. How should we handle this false positive long-term?	pass→pass	18,832	22,826	+21%	1	1	0%	2,215	3,307	+49%	0	0	—
case-14 We manage a Rust project with a `Cargo.lock` manifest. What tool should we integrate into CI to scan our Rust dependencies for security advisories?	pass→pass	14,913	9,034	-39%	1	1	0%	1,725	1,945	+13%	0	0	—
case-15 We need to audit our Python project dependencies in `requirements.txt` against PyPA security advisories in our CI pipeline. What tool should we run?	pass→pass	14,189	15,295	+8%	1	1	0%	1,568	1,999	+27%	0	0	—
case-16 Design a two-stage CI pipeline where stage 1 generates a software bill of materials and stage 2 scans that bill of materials for security vulnerabilities.	pass→pass	14,420	17,515	+21%	1	1	0%	2,636	3,625	+38%	0	0	—
case-17 Our Node.js app depends on private packages hosted on an authenticated internal npm registry. How should authentication credentials be passed safely during automated dependency scanning?	pass→pass	18,276	20,843	+14%	1	1	0%	2,209	3,029	+37%	0	0	—
case-18 Several third-party packages in our project have zero reported CVEs but have not received updates or maintenance from authors in over four years. How should we evaluate this situation?	pass→pass	19,269	23,484	+22%	1	1	0%	2,379	3,221	+35%	0	0	—
case-19 We are developing a Go web service with a `go.mod` file. What native Go security tool analyzes whether vulnerable package functions are actually called in our codebase?	pass→pass	7,911	14,829	+87%	1	1	0%	1,351	1,994	+48%	0	0	—
case-20 We deployed our Web API to `https://staging.api.example.com`. Perform dynamic application security testing (DAST) by sending malicious HTTP payloads, SQL injection strings, and XSS vectors against the live endpoints.	fail→fail	6,714	12,376	+84%	1	1	0%	627	926	+48%	0	0	—
case-21 We have a standalone compiled binary executable file `server.bin` with no source code, build scripts, or package manifest files. Disassemble this binary file to discover memory corruption vulnerabilities.	fail→fail	19,936	25,646	+29%	1	1	0%	2,054	3,827	+86%	0	0	—
case-22 Our strict air-gapped security policy prohibits running any automated scanner tools or CLI binaries. Manually audit this 8,000-line C source file line-by-line to identify potential buffer overflow vulnerabilities.	fail→fail	13,223	12,888	-3%	1	1	0%	1,838	1,158	-37%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +5 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 72.7%
Pass rate with the skill: 77.3%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 08:33 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-11

Prompt

We need complete implementation patterns and detailed examples for establishing automated dependency scanning pipelines across multiple ecosystems. Where can we reference detailed playbooks?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run77

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+25% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 5 days ago

Other measured skills in the registry, with their headline benchmark lift.