/cve-scan

name: cve-scan
description: "Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart). Triggers: CVE scan, vulnerability scan, npm audit, pip audit."
user-invocable: true
effort: medium
argument-hint: "[--ecosystem npm|pip|composer|cargo|go|ruby|dart] [--fix] [--json]"
allowed-tools: Read, Grep, Glob, Bash

/cve-scan - Dependency CVE Scanner

$ARGUMENTS

Detect project ecosystems and scan dependencies for known vulnerabilities using native audit tools. Zero external dependencies — uses tools already installed in the project environment.

Usage

/cve-scan                        # Auto-detect all ecosystems, scan all
/cve-scan --ecosystem npm        # Force specific ecosystem
/cve-scan --fix                  # Auto-fix where possible (npm audit fix, etc.)
/cve-scan --json                 # Machine-readable JSON output

What This Command Does

1. **Detect** package managers by lock/manifest files in the project 2. **Run** the native audit command for each detected ecosystem 3. **Parse** results into a unified severity-based report 4. **Report** CVE IDs, affected packages, installed vs fixed versions, advisory links 5. **Fix** automatically when `--fix` is passed (where the tool supports it)

Ecosystem Detection & Commands

| Manifest File | Lock File | Ecosystem | Audit Command | CVE Database | |---------------|-----------|-----------|---------------|--------------| | `package.json` | `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` | npm/yarn/pnpm | `npm audit --json` / `yarn audit --json` / `pnpm audit --json` | GitHub Advisory DB | | `requirements.txt` / `pyproject.toml` / `setup.py` | `requirements.txt` | pip | `pip-audit --format=json` | OSV / PyPI Advisory | | `composer.json` | `composer.lock` | composer | `composer audit --format=json` | Packagist / FriendsOfPHP | | `Cargo.toml` | `Cargo.lock` | cargo | `cargo audit --json` | RustSec Advisory DB | | `go.mod` | `go.sum` | go | `govulncheck ./...` | Go Vulnerability DB | | `Gemfile` | `Gemfile.lock` | bundler | `bundle-audit check` | Ruby Advisory DB | | `pubspec.yaml` | `pubspec.lock` | dart/flutter | `dart pub outdated --json` | pub.dev |

Steps

1. **Detect ecosystems**: Glob for manifest/lock files at project root and common subdirectories 2. **Check tool availability**: Verify audit tool is installed for each detected ecosystem 3. **Run audit**: Execute native audit command, capture JSON output where available 4. **Parse results**: Extract CVE ID, package name, installed version, fixed version, severity, advisory URL 5. **Unified report**: Merge all ecosystems into single report sorted by severity 6. **Fix mode**: If `--fix` passed, run `npm audit fix`, `pip-audit --fix`, `cargo audit fix` etc. 7. **Exit code**: Non-zero if any CRITICAL or HIGH vulnerabilities found

Detection Script

Run the bundled detection script to quickly identify ecosystems and tool availability:

python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py

Options:

python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --json      # JSON output
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --fix        # Auto-fix mode
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --ecosystem npm  # Specific ecosystem

Output Format

## CVE Scan Report

### Ecosystems Detected
- npm (package-lock.json) — `npm audit` available ✓
- pip (requirements.txt) — `pip-audit` not installed ⚠️

### Summary
| Severity | Count |
|----------|-------|
| CRITICAL | 1 |
| HIGH | 3 |
| MEDIUM | 5 |
| LOW | 2 |

### Findings

#### [CRITICAL] lodash@4.17.20 (npm)
- **CVE**: CVE-2021-23337
- **Title**: Prototype Pollution
- **Fixed in**: 4.17.21
- **Advisory**: https://github.com/advisories/GHSA-35jh-r3h4-6jhm

#### [HIGH] django@3.2.0 (pip)
- **CVE**: CVE-2023-36053
- **Title**: Potential ReDoS in EmailValidator
- **Fixed in**: 3.2.20
- **Advisory**: https://osv.dev/vulnerability/PYSEC-2023-100

### Tool Availability
| Ecosystem | Tool | Status | Install Hint |
|-----------|------|--------|--------------|
| npm | npm audit | ✓ installed | — |
| pip | pip-audit | ✗ missing | `pip install pip-audit` |
| cargo | cargo-audit | ✗ missing | `cargo install cargo-audit` |

Handling Missing Tools

When an audit tool is not installed, the skill: 1. Reports it as a warning (not a failure) 2. Provides the install command for the missing tool 3. Continues scanning other detected ecosystems

Install hints per ecosystem:

| Tool | Install Command | |------|----------------| | `pip-audit` | `pip install pip-audit` | | `cargo-audit` | `cargo install cargo-audit` | | `govulncheck` | `go install golang.org/x/vuln/cmd/govulncheck@latest` | | `bundle-audit` | `gem install bundler-audit` | | `composer` | Built-in since Composer 2.4 |

Rules

• Never modify `package-lock.json`, `Cargo.lock`, or other lock files without `--fix` flag
• Always report tool availability — missing tool is a finding, not a failure
• Parse JSON output when available for structured data; fall back to text parsing
• CRITICAL and HIGH findings should be highlighted prominently
• Include advisory URLs for every CVE when available
• This skill is READ-ONLY by default (no installs, no upgrades) unless `--fix` is passed
• Respect `.auditrc`, `.nsprc`, or equivalent ignore files if present