/dep-security

name: dep-security
description: >
  Check every dependency in a package.json against live CVE databases and security advisories
  in real time — specifically targeting vulnerabilities disclosed in the last 48 hours, the
  window that Snyk, Dependabot, and npm audit miss.
  Use this skill whenever a user mentions checking dependencies for vulnerabilities, wants to
  audit their package.json, asks about CVEs for their packages, says "are my dependencies safe",
  "check my packages for security issues", "any new vulnerabilities in my deps", or pastes a
  package.json and asks about security. Also trigger when a user mentions wanting fresher data
  than Snyk or Dependabot provides.
  Returns: which dependencies have brand-new vulnerabilities, severity, what the vulnerability
  does, whether a patched version exists yet, and a prioritised fix list.
compatibility:
  tools: [tinyfish]
metadata:
  author: tinyfish-community
  version: "1.0"
  tags: security cve vulnerabilities dependencies npm package.json devops

Dependency Security Checker

Given a `package.json`, check every dependency against live CVE databases and security advisories — focusing on the last 48 hours, the window that cached tools miss.

Pre-flight check

tinyfish --version
tinyfish auth status

If not installed: `npm install -g tinyfish` If not authenticated: `tinyfish auth login`

---

Step 1 — Parse dependencies

Read the `package.json` the user provided. Extract all package names and versions from:

• `dependencies`
• `devDependencies`
• `peerDependencies` (if present)

Produce a flat list: `[{name, version, type}]`

If the user hasn't provided a `package.json`, ask for it before proceeding. Do not guess.

Get today's date. Calculate the cutoff timestamp: **now minus 48 hours**. You will use this to filter results in every agent below.

---

Step 2 — Batch packages

Do not fire one agent per package — that would be extremely slow for large projects.

Instead batch into groups of up to **10 packages per agent** and search for all of them at once. For a typical `package.json` with 20–40 deps, this means 2–4 agents total per source, all running in parallel.

Format each batch as a comma-separated search string: `express,lodash,axios,react,webpack` etc.

---

Step 3 — Parallel security scan

Fire all agents simultaneously using `&` + `wait`. Each agent searches one source for all batches at once.

# ── BATCH SETUP ──────────────────────────────────────────────
# Split your package list into batches of 10, e.g.:
# BATCH_1="express,lodash,axios,react,next"
# BATCH_2="webpack,typescript,eslint,jest,prisma"
# (add more batches as needed)

TODAY=$(date +%Y-%m-%d)

# ── CVE DATABASE ─────────────────────────────────────────────
# One agent per batch, all in parallel

tinyfish agent run \
  --url "https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword={BATCH_1}" \
  "You are on a CVE search results page. Today is {TODAY}.
   You are looking for CVEs related to these npm packages: {BATCH_1}.
   Scan ALL visible results on this page.
   For each CVE that matches one of these package names AND was published or modified within the last 48 hours:
   - CVE ID
   - Package name it affects
   - Severity (if shown)
   - One-sentence description of what the vulnerability does
   - Publication date
   STRICT RULES:
   - Do NOT click any CVE link
   - Do NOT paginate
   - Only include results from the last 48 hours — ignore older ones
   - If nothing is within 48 hours, return an empty array
   Return JSON array: [{cve_id, package, severity, description, published_date}]" \
  --sync > /tmp/ds_cve_1.json &

# Repeat for each batch:
tinyfish agent run \
  --url "https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword={BATCH_2}" \
  "You are on a CVE search results page. Today is {TODAY}.
   You are looking for CVEs related to these npm packages: {BATCH_2}.
   Scan ALL visible results on this page.
   For each CVE that matches one of these package names AND was published or modified within the last 48 hours:
   - CVE ID, package name, severity, one-sentence description, publication date
   STRICT RULES:
   - Do NOT click any CVE link — read the listing text only
   - Do NOT paginate
   - Only include results from the last 48 hours
   Return JSON array: [{cve_id, package, severity, description, published_date}]" \
  --sync > /tmp/ds_cve_2.json &

# ── GITHUB SECURITY ADVISORIES ───────────────────────────────

tinyfish agent run \
  --url "https://github.com/advisories?query=ecosystem%3Anpm&order=newest" \
  "You are on the GitHub Security Advisories page filtered to npm, sorted by newest first. Today is {TODAY}.
   Read through the visible advisory listings on this page.
   For each advisory that:
   1. Affects any of these packages: {ALL_PACKAGES}
   2. Was published within the last 48 hours
   Extract:
   - Advisory ID (GHSA-...)
   - Package name
   - Severity (Critical / High / Medium / Low)
   - One-sentence description
   - Published date
   - Patched version (if shown in the listing)
   STRICT RULES:
   - Do NOT click any advisory to open it
   - Do NOT paginate or click 'Load more'
   - Scan only the first 30 visible listings then stop
   - 48-hour cutoff is strict — ignore anything older
   Return JSON array: [{ghsa_id, package, severity, description, published_date, patched_version}]" \
  --sync > /tmp/ds_ghsa.json &

# ── NPM SECURITY FEED ────────────────────────────────────────

tinyfish agent run \
  --url "https://www.npmjs.com/advisories" \
  "You are on the npm security advisories page. Today is {TODAY}.
   Read through the visible advisory listings.
   For each advisory that:
   1. Affects any of these packages: {ALL_PACKAGES}
   2. Was published within the last 48 hours
   Extract:
   - Advisory ID
   - Package name
   - Severity
   - One-sentence description of the vulnerability
   - Vulnerable version range
   - Patched version (if shown)
   - Published date
   STRICT RULES:
   - Do NOT click any adv