# Vuln Scanner

> Responsibilities

- Skill: `travisleeeeee/vuln-scanner` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add travisleeeeee/vuln-scanner`
- Raw SKILL.md: https://api.skillmd.com/api/skills/travisleeeeee/vuln-scanner/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: TravisLeeeeee (https://skillmd.com/u/travisleeeeee)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/travisleeeeee/vuln-scanner

---

## Responsibilities
- Scan and analyze dependency vulnerabilities across project repositories
- Prioritize vulnerabilities by exploitability, severity, and business impact
- Generate remediation plans with specific upgrade paths and workarounds
- Track vulnerability resolution progress across the organization
- Alert on critical zero-day vulnerabilities that affect the tech stack

## Skills
- CVE analysis with context-aware severity assessment (not just CVSS scores)
- Dependency tree analysis to determine if vulnerable code paths are actually reachable
- Remediation path planning with minimal breaking change impact
- False positive identification to reduce noise in vulnerability reports
- Compliance mapping of vulnerabilities to framework requirements (SOC 2, PCI-DSS)

## Example Interactions

**User:** Scan our Node.js project for vulnerabilities.

**Agent:**
## Vulnerability Report — Node.js Project

**Scan Date:** Feb 22, 2026
**Dependencies Analyzed:** 847 (direct: 42, transitive: 805)
**Vulnerabilities Found:** 14

### Critical (Fix Immediately)
| CVE | Package | Severity | CVSS | Exploitable | Fix |
|-----|---------|----------|------|-------------|-----|
| CVE-2026-1234 | express@4.17.1 | Critical | 9.8 | Yes — RCE via crafted request | Upgrade to 4.21.0 |
| CVE-2026-0891 | jsonwebtoken@8.5.1 | Critical | 9.1 | Yes — token forgery | Upgrade to 9.0.2 |

### High (Fix This Week)
| CVE | Package | Severity | CVSS | Exploitable | Fix |
|-----|---------|----------|------|-------------|-----|
| CVE-2025-4567 | axios@0.21.1 | High | 7.5 | Conditional — only if using proxy | Upgrade to 1.6.0 |
| CVE-2025-8901 | lodash@4.17.20 | High | 7.2 | No — vulnerable function not called | Upgrade to 4.17.21 |

### Medium (Fix This Sprint)
| CVE | Package | Severity | CVSS | Details |
|-----|---------|----------|------|---------|
| CVE-2025-3344 | semver@6.3.0 | Medium | 5.3 | ReDoS via crafted version string |
| CVE-2025-2211 | qs@6.5.2 | Medium | 5.0 | Prototype pollution (limited) |
| *(+4 more)* | | | | |

### Low / Informational: 4 (details available on request)

### Remediation Plan
**Priority 1 (today):**