cve-scan

---
name: cve-scan
description: "Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart). Triggers: CVE scan, vulnerability scan, npm audit, pip audit."
user-invocable: true
effort: medium
argument-hint: "[--ecosystem npm|pip|composer|cargo|go|ruby|dart] [--fix] [--json]"
allowed-tools: Read, Grep, Glob, Bash
---

# /cve-scan - Dependency CVE Scanner

$ARGUMENTS

Detect project ecosystems and scan dependencies for known vulnerabilities using native audit tools. Zero external dependencies — uses tools already installed in the project environment.

## Usage

```
/cve-scan                        # Auto-detect all ecosystems, scan all
/cve-scan --ecosystem npm        # Force specific ecosystem
/cve-scan --fix                  # Auto-fix where possible (npm audit fix, etc.)
/cve-scan --json                 # Machine-readable JSON output
```

## What This Command Does

1. **Detect** package managers by lock/manifest files in the project
2. **Run** the native audit command for each detected ecosystem
3. **Parse** results into a unified severity-based report
4. **Report** CVE IDs, affected packages, installed vs fixed versions, advisory links
5. **Fix** automatically when `--fix` is passed (where the tool supports it)

## Ecosystem Detection & Commands

| Manifest File | Lock File | Ecosystem | Audit Command | CVE Database |
|---------------|-----------|-----------|---------------|--------------|
| `package.json` | `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` | npm/yarn/pnpm | `npm audit --json` / `yarn audit --json` / `pnpm audit --json` | GitHub Advisory DB |
| `requirements.txt` / `pyproject.toml` / `setup.py` | `requirements.txt` | pip | `pip-audit --format=json` | OSV / PyPI Advisory |
| `composer.json` | `composer.lock` | composer | `composer audit --format=json` | Packagist / FriendsOfPHP |
| `Cargo.toml` | `Cargo.lock` | cargo | `cargo audit --json` | RustSec Advisory DB |
| `go.mod` | `go.sum` | go | `govulncheck ./...` | Go Vulnerability DB |
| `Gemfile` | `Gemfile.lock` | bundler | `bundle-audit check` | Ruby Advisory DB |
| `pubspec.yaml` | `pubspec.lock` | dart/flutter | `dart pub outdated --json` | pub.dev |

## Steps

1. **Detect ecosystems**: Glob for manifest/lock files at project root and common subdirectories
2. **Check tool availability**: Verify audit tool is installed for each detected ecosystem
3. **Run audit**: Execute native audit command, capture JSON output where available
4. **Parse results**: Extract CVE ID, package name, installed version, fixed version, severity, advisory URL
5. **Unified report**: Merge all ecosystems into single report sorted by severity
6. **Fix mode**: If `--fix` passed, run `npm audit fix`, `pip-audit --fix`, `cargo audit fix` etc.
7. **Exit code**: Non-zero if any CRITICAL or HIGH vulnerabilities found

## Detection Script

Run the bundled detection script to quickly identify ecosystems and tool availability:

```bash
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py
```

Options:
```bash
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --json      # JSON output
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --fix        # Auto-fix mode
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --ecosystem npm  # Specific ecosystem
```

## Output Format

```markdown
## CVE Scan Report

### Ecosystems Detected
- npm (package-lock.json) — `npm audit` available ✓
- pip (requirements.txt) — `pip-audit` not installed ⚠️

### Summary
| Severity | Count |
|----------|-------|
| CRITICAL | 1 |
| HIGH | 3 |
| MEDIUM | 5 |
| LOW | 2 |

### Findings

#### [CRITICAL] [email protected] (npm)
- **CVE**: CVE-2021-23337
- **Title**: Prototype Pollution
- **Fixed in**: 4.17.21
- **Advisory**: https://github.com/advisories/GHSA-35jh-r3h4-6jhm

#### [HIGH] [email protected] (pip)
- **CVE**: CVE-2023-36053
- **Title**: Potential ReDoS in EmailValidator
- **Fixed in**: 3.2.20
- **Advisory**: https://osv.dev/vulnerability/PYSEC-2023-100

### Tool Availability
| Ecosystem | Tool | Status | Install Hint |
|-----------|------|--------|--------------|
| npm | npm audit | ✓ installed | — |
| pip | pip-audit | ✗ missing | `pip install pip-audit` |
| cargo | cargo-audit | ✗ missing | `cargo install cargo-audit` |
```

## Handling Missing Tools

When an audit tool is not installed, the skill:
1. Reports it as a warning (not a failure)
2. Provides the install command for the missing tool
3. Continues scanning other detected ecosystems

Install hints per ecosystem:

| Tool | Install Command |
|------|----------------|
| `pip-audit` | `pip install pip-audit` |
| `cargo-audit` | `cargo install cargo-audit` |
| `govulncheck` | `go install golang.org/x/vuln/cmd/govulncheck@latest` |
| `bundle-audit` | `gem install bundler-audit` |
| `composer` | Built-in since Composer 2.4 |

## Rules

- Never modify `package-lock.json`, `Cargo.lock`, or other lock files without `--fix` flag
- Always report tool availability — missing tool is a finding, not a failure
- Parse JSON output when available for structured data; fall back to text parsing
- CRITICAL and HIGH findings should be highlighted prominently
- Include advisory URLs for every CVE when available
- This skill is READ-ONLY by default (no installs, no upgrades) unless `--fix` is passed
- Respect `.auditrc`, `.nsprc`, or equivalent ignore files if present