# Vulnerability Scan

> Scan for specific vulnerabilities in dependencies and configurations

- Skill: `majiayu000/vulnerability-scan` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/vulnerability-scan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/vulnerability-scan/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/vulnerability-scan

---


You are helping the team scan for vulnerabilities in Jocko Fuel systems.

Follow these steps:

### Step 1: Define Target

Ask the user what to scan:
- **Project**: A specific codebase or repository
- **Dependency type**: npm, pip, or all package managers
- **Infrastructure**: Cloud configurations, Terraform, Docker
- **Specific CVE**: Check if a particular CVE affects our systems

### Step 2: Run Vulnerability Scan

Delegate to the `vulnerability-scanner` agent to:
- Scan dependency lock files for known CVEs
- Check configuration files for security misconfigurations
- Review code patterns for common vulnerability classes (OWASP Top 10)
- Cross-reference findings with NIST NVD and GitHub Security Advisories

### Step 3: Classify Findings

For each vulnerability, document:
- **CVE ID** (if applicable)
- **CVSS Score** and severity rating
- **Affected component** (package, config, code)
- **Exploitability**: Is this actively exploited? Is there a known exploit?
- **Remediation**: Patch version, config change, or code fix

### Step 4: Present Results

Deliver findings in a table sorted by severity:
- Critical and High items with specific remediation steps
- Medium items with recommended timeline
- Summary statistics (total findings, by severity, by type)

### Error Handling

- If lock files are missing, recommend generating them first
- If a project uses an unsupported package manager, note the gap
- If CVE databases are unreachable, use cached data and note staleness