How do I install the Sca Runner skill?

Run npx skillmds@latest add aibot88/sca-runner in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sca Runner safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: WARNING. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sca Runner?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sca Runner free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sca Runner?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sca Runner by aibot88 — Agent Skill

Name: Sca Runner
Rating: 4.2 (5 reviews)
Author: aibot88

Sca Runner

Runs Software Composition Analysis (SCA) to detect vulnerable dependencies. Wraps npm audit and Trivy fs. Use when user asks to "scan dependencies", "check npm vulnerabilities", "SCA scan", "dependency audit", "依存関係スキャン", "脆弱性チェック".

aibot88 Updated Sep 9, 2026 3 repo stars

File contents

SCA Runner

Wrapper for npm audit and Trivy to perform Software Composition Analysis.

Prerequisites

At least one of these tools must be installed:

# npm audit (built into npm)
npm --version

# Trivy (recommended for multi-language support)
brew install trivy
# or
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

Usage

# Scan with auto-detection (prefers Trivy if available)
npx sca-runner .

# Force specific scanner
npx sca-runner . --scanner npm
npx sca-runner . --scanner trivy

# JSON output
npx sca-runner . --json

# Check available scanners
npx sca-runner --check

# Scan specific package file
npx sca-runner ./package-lock.json --scanner npm

Supported Package Managers

Scanner	Languages/Files
npm audit	Node.js (package-lock.json)
Trivy	Node.js, Python, Go, Ruby, Rust, Java, .NET

Output Format

{
  "tool": "trivy",
  "scanPath": ".",
  "scanDate": "2024-01-15T10:30:00Z",
  "findings": [
    {
      "id": "CVE-2024-1234",
      "severity": "critical",
      "package": "lodash",
      "installedVersion": "4.17.20",
      "fixedVersion": "4.17.21",
      "title": "Prototype Pollution",
      "description": "...",
      "cvss": 9.8,
      "cwes": ["CWE-1321"],
      "references": ["https://nvd.nist.gov/..."]
    }
  ],
  "summary": {
    "total": 5,
    "critical": 1,
    "high": 2,
    "medium": 1,
    "low": 1
  }
}

Exit Codes

0: No vulnerabilities found
1: Vulnerabilities detected
2: Tool not installed or error

Common CVEs Detected

Prototype Pollution (CWE-1321)
Regular Expression DoS (CWE-1333)
Path Traversal (CWE-22)
Code Injection (CWE-94)
Denial of Service (CWE-400)

---name: sca-runnerdescription: Runs Software Composition Analysis (SCA) to detect vulnerable dependencies. Wraps npm audit and Trivy fs. Use when user asks to "scan dependencies", "check npm vulnerabilities", "SCA scan", "dependency audit", "依存関係スキャン", "脆弱性チェック".--- # SCA Runner Wrapper for npm audit and Trivy to perform Software Composition Analysis. ## Prerequisites At least one of these tools must be installed: ```bash # npm audit (built into npm) npm --version # Trivy (recommended for multi-language support) brew install trivy # or curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ``` ## Usage ```bash # Scan with auto-detection (prefers Trivy if available) npx sca-runner . # Force specific scanner npx sca-runner . --scanner npm npx sca-runner . --scanner trivy # JSON output npx sca-runner . --json # Check available scanners npx sca-runner --check # Scan specific package file npx sca-runner ./package-lock.json --scanner npm ``` ## Supported Package Managers | Scanner | Languages/Files | |---------|-----------------| | npm audit | Node.js (package-lock.json) | | Trivy | Node.js, Python, Go, Ruby, Rust, Java, .NET | ## Output Format ```json { "tool": "trivy", "scanPath": ".", "scanDate": "2024-01-15T10:30:00Z", "findings": [ { "id": "CVE-2024-1234", "severity": "critical", "package": "lodash", "installedVersion": "4.17.20", "fixedVersion": "4.17.21", "title": "Prototype Pollution", "description": "...", "cvss": 9.8, "cwes": ["CWE-1321"], "references": ["https://nvd.nist.gov/..."] } ], "summary": { "total": 5, "critical": 1, "high": 2, "medium": 1, "low": 1 } } ``` ## Exit Codes - `0`: No vulnerabilities found - `1`: Vulnerabilities detected - `2`: Tool not installed or error ## Common CVEs Detected - Prototype Pollution (CWE-1321) - Regular Expression DoS (CWE-1333) - Path Traversal (CWE-22) - Code Injection (CWE-94) - Denial of Service (CWE-400)

Frequently asked questions