Skip to content
Agentmart
Submit a tool

dependency-cve-check

Checks dependencies for known CVEs and risky versions across npm, Maven/Gradle, Python, and .NET ecosystems, using OSV as the data source.

Skill by felipegiannetti

IndexedMIT
Write a review

Chalk Labs

Need help deploying dependency-cve-check?

Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.

Book a call

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/felipegiannetti-dependency-cve-check

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Checks dependencies for known CVEs and risky versions across npm, Maven/Gradle, Python, and .NET ecosystems, using OSV as the data source. Use when reviewing manifest/lockfile changes.

Use cases: data, security

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools
No tools found
Secrets
None asked for
Install scripts
None found

Network hosts it talks to 1

  • codeload.github.com · found in install command

Files it touches

  • ~/.claude/skills/dependency-cve-check

What's inside

Skill name
dependency-cve-check
Description
Checks dependencies for known CVEs and risky versions across npm, Maven/Gradle, Python, and .NET ecosystems, using OSV as the data source. Use when reviewing manifest/lockfile changes.
License
MIT
Instructions
26 lines in SKILL.md · view on GitHub

Agent Skills spec issues

  • files: referenced but missing: scripts/discovery/detect_dependencies.py, scripts/scanners/run_osv_scanner.py, scripts/scanners/check_kev.py, scripts/scanners/check_cve_policy.py

Files (8)

  • SKILL.md
  • cve-policy.md · references/
  • dotnet.md · references/
  • kev-correlation.md · references/
  • maven-gradle.md · references/
  • npm.md · references/
  • osv.md · references/
  • python.md · references/

SKILL.md (first lines)

# Dependency CVE Check

- [npm](references/npm.md)
- [Maven / Gradle](references/maven-gradle.md)
- [Python](references/python.md)
- [.NET](references/dotnet.md)
- [OSV](references/osv.md)
- [KEV Correlation](references/kev-correlation.md)
- [CVE Age/Severity Policy](references/cve-policy.md)

## Process

1. Use `scripts/discovery/detect_dependencies.py` to locate manifests/lockfiles, then `scripts/scanners/run_osv_scanner.py` to identify CVEs against them — see the ecosystem-specific reference above for how to resolve the *actually installed* version from each ecosystem's manifest/lockfile pair.
2. Correlate each CVE per [osv.md](references/osv.md) "Correlation Requirements" — a match is a `CANDIDATE`, not evidence the vulnerable code path is reachable in this application.
3. Run `scripts/scanners/check_kev.py` to tag each finding with CISA KEV (Known Exploited Vulnerabilities) status — see [kev-correlation.md](references/kev-correlation.md) for the full methodology and why this changes *priority*, not severity.
4. Run `scripts/scanners/check_cve_policy.py` to flag CVEs meeting a configurable severity/recency policy, independent of confirmed KEV status — see [cve-policy.md](references/cve-policy.md).

## When to Use

Whenever manifest/lockfile changes are in scope, or as part of `05_static_security_scanning` for a full-repository review — always in combination with `dependency-cve-check`'s always-run status per [workflow/routing_rules.yaml](../../workflow/routing_rules.yaml).

## Output

A candidate finding conforming to [finding.schema.json](../../schemas/finding.schema.json), with `kev` populated once `check_kev.py` has run and `cve_policy` populated once `check_cve_policy.py` has run.

From felipegiannetti/claude-security-agents, MIT.

More from felipegiannetti/claude-security-agents

Signals

Stars
0
Forks
0
Open issues
0
Last commit (this folder)
Aug 13, 2026 (2 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License
MIT
Repository
github.com/felipegiannetti/claude-security-agents
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
GitHubgithub-graphql

More from felipegiannetti

Done for you

Rather not set it up yourself?

Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.

See how we build AI agents →Read the case studies

Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.

launches shipped
50+
launches shipped
media placements
500+
media placements
founders on every account
2
founders on every account

Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block

Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.

Get dependency-cve-check running in your business

Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.

Goes to the Chalk Labs founders, not the newsletter. Privacy

Need help deploying dependency-cve-check?

CallGet help
Cite this page

dependency-cve-check skill. Agent Mart. https://agentmart.dev/skills/felipegiannetti-dependency-cve-check (last updated 2026-10-24)