Individual skill

evo-software-dependency-audit

Security audit skill for scanning dependency files (e.g., package-lock.json) using Trivy offline scanner to identify HIGH/CRITICAL vulnerabilities and produce CSV reports.

tasks-evolved/software-dependency-audit/environment/skills/evo-software-dependency-audit/SKILL.md

Read pinned source

Source commit 84ca182da055fafb6453dcec4a6defdbbfd987c1

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Local scripts
Last checked: Nov 6, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 97
Repository last updated: Sep 10, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
llm-agents Repository topic
open-world Repository topic
self-evolving-agents Repository topic
security Derived category
engineering Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 4,028 bytes
SKILL.mdcore · 4,028 bytes
SKILL.mdcore · 4,028 bytes
SKILL.mdcore · 4,028 bytes
scripts/run_audit.pyruns · 1,149 bytes
scripts/utils.pyruns · 17,269 bytes

Read excerpt


# evo-software-dependency-audit

## CRITICAL: You MUST Use Trivy (Not npm audit)

**DO NOT use `npm audit`, `yarn audit`, `snyk`, or any other tool.** The ONLY correct tool for this task is **Trivy** with its pre-built offline vulnerability database. Using any other tool will produce incorrect results because different tools use different vulnerability databases with different CVE mappings, CVSS scores, and fixed version information.

Trivy is already installed and its offline database is pre-loaded. You do not need internet access.

## Quickest Path to Solution

A complete, ready-to-run Python script is provided. Simply execute it:

```bash
python3 /root/.claude/skills/evo-software-dependency-audit/scripts/run_audit.py