mcpField
S
sca-audit

sca-audit

github.com/owaspSecurity208293 installsUpdated 2w ago
Repository

About sca-audit

sca-audit is a security skill for scanning project dependencies for known CVEs and reviewing dependency health. It guides users through scanner selection, vulnerability analysis, and prioritized remediation.

Key features

  1. 01Dependency manifest and lockfile discovery
  2. 02Multi-ecosystem vulnerability scanning
  3. 03Reachability and fix analysis
  4. 04Maintenance, license, and pinning checks
  5. 05Severity-ranked findings and remediation commands

Use cases

  1. 01Checking a repository for known dependency CVEs
  2. 02Assessing whether vulnerable code paths are reachable
  3. 03Identifying outdated or concerning dependencies

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/owasp/secure-agent-playbook --skill sca-audit

After installing, type/sca-auditin Claude Code to confirm it loaded.

Details

From the project README

Software Composition Analysis Audit

Scan dependencies for known CVEs by following the full procedure in plays/sca-audit.md.

Steps

  1. Identify Dependency Manifests — Scan for all dependency files and lockfiles across ecosystems (Node.js, Python, Go, Java, Ruby, Rust, .NET, PHP). Prefer lockfiles for exact resolved versions.

  2. Run Vulnerability Scan — Use available tools in preference order:

    • osv-scanner --lockfile=<path> --format=json (recommended, multi-ecosystem)
    • npm audit --json (Node.js)
    • pip-audit -r requirements.txt --format=json (Python)
    • govulncheck ./... (Go)
    • trivy fs --format json --scanners vuln <path> (multi-ecosystem)
    • If no scanner is installed, stop and ask the user to install one (e.g., brew install osv-scanner). Manual analysis is not viable — even small projects have 50+ dependencies. For individual package triage, point the user to OSV.dev.

  3. Analyze Results — For each vulnerability: determine reachability (is the vulnerable code path used?), check exploitability context (deployment matters), and identify fix availability (patch vs major version bump).

  4. Dependency Health — Beyond CVEs, flag unmaintained packages (2+ years inactive), typosquatting risks, license concerns, and version pinning issues.

Output

Scan summary (ecosystems, dependency count, scanner used), findings sorted by severity using templates/finding.md, condensed table for medium/low, dependency health flags, and exact remediation commands.

OWASP References

  • A06:2021: Vulnerable and Outdated Components
  • OWASP Dependency-Check
  • OWASP SCVS

Comments

Markdown supported