Cve Scan

/cve-scan - Dependency CVE Scanner

$ARGUMENTS

Detect project ecosystems and scan dependencies for known vulnerabilities using native audit tools. Zero external dependencies — uses tools already installed in the project environment.

Usage

/cve-scan                        # Auto-detect all ecosystems, scan all
/cve-scan --ecosystem npm        # Force specific ecosystem
/cve-scan --fix                  # Auto-fix where possible (npm audit fix, etc.)
/cve-scan --json                 # Machine-readable JSON output

What This Command Does

1. Detect package managers by lock/manifest files in the project
2. Run the native audit command for each detected ecosystem
3. Parse results into a unified severity-based report
4. Report CVE IDs, affected packages, installed vs fixed versions, advisory links
5. Fix automatically when --fix is passed (where the tool supports it)

Ecosystem Detection & Commands

Steps

1. Detect ecosystems: Glob for manifest/lock files at project root and common subdirectories
2. Check tool availability: Verify audit tool is installed for each detected ecosystem
3. Run audit: Execute native audit command, capture JSON output where available
4. Parse results: Extract CVE ID, package name, installed version, fixed version, severity, advisory URL
5. Unified report: Merge all ecosystems into single report sorted by severity
6. Fix mode: If --fix passed, run npm audit fix, pip-audit --fix, cargo audit fix etc.
7. Exit code: Non-zero if any CRITICAL or HIGH vulnerabilities found

Detection Script

Run the bundled detection script to quickly identify ecosystems and tool availability:

python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py

Options:

python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --json      # JSON output
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --fix        # Auto-fix mode
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --ecosystem npm  # Specific ecosystem

Output Format

## CVE Scan Report

### Ecosystems Detected
- npm (package-lock.json) — `npm audit` available ✓
- pip (requirements.txt) — `pip-audit` not installed ⚠️

### Summary
| Severity | Count |
|----------|-------|
| CRITICAL | 1 |
| HIGH | 3 |
| MEDIUM | 5 |
| LOW | 2 |

### Findings

#### [CRITICAL] lodash@4.17.20 (npm)
- **CVE**: CVE-2021-23337
- **Title**: Prototype Pollution
- **Fixed in**: 4.17.21
- **Advisory**: https://github.com/advisories/GHSA-35jh-r3h4-6jhm

#### [HIGH] django@3.2.0 (pip)
- **CVE**: CVE-2023-36053
- **Title**: Potential ReDoS in EmailValidator
- **Fixed in**: 3.2.20
- **Advisory**: https://osv.dev/vulnerability/PYSEC-2023-100

### Tool Availability
| Ecosystem | Tool | Status | Install Hint |
|-----------|------|--------|--------------|
| npm | npm audit | ✓ installed | — |
| pip | pip-audit | ✗ missing | `pip install pip-audit` |
| cargo | cargo-audit | ✗ missing | `cargo install cargo-audit` |

Handling Missing Tools

When an audit tool is not installed, the skill:

1. Reports it as a warning (not a failure)
2. Provides the install command for the missing tool
3. Continues scanning other detected ecosystems

Install hints per ecosystem:

Rules

• Never modify package-lock.json, Cargo.lock, or other lock files without --fix flag
• Always report tool availability — missing tool is a finding, not a failure
• Parse JSON output when available for structured data; fall back to text parsing
• CRITICAL and HIGH findings should be highlighted prominently
• Include advisory URLs for every CVE when available
• This skill is READ-ONLY by default (no installs, no upgrades) unless --fix is passed
• Respect .auditrc, .nsprc, or equivalent ignore files if present