Dependency Checker Skill

Overview

Software Composition Analysis (SCA) skill for identifying vulnerable dependencies, outdated packages, and license compliance issues across multiple package managers and languages.

Capabilities

1. Vulnerability Detection

• Known CVE detection in dependencies
• Transitive dependency analysis
• Severity assessment (Critical, High, Medium, Low)
• Exploit availability checking
• Patch availability verification

2. Dependency Management

• Outdated package identification
• Version conflict detection
• Breaking change alerts
• Update recommendations
• Lock file validation

3. License Compliance

• License compatibility checking
• GPL/LGPL contamination detection
• Commercial use restrictions
• Attribution requirements

4. Multi-Language Support

• JavaScript/TypeScript: npm, yarn, pnpm
• Python: pip, pipenv, poetry
• Java: Maven, Gradle
• Ruby: Bundler
• Go: go.mod
• .NET: NuGet
• PHP: Composer

Tools Integration

Snyk (Primary Tool)

Industry-leading SCA with AI-powered fix recommendations:

# Install Snyk
npm install -g snyk

# Authenticate
snyk auth

# Test for vulnerabilities
snyk test

# Monitor for new vulnerabilities
snyk monitor

# Fix vulnerabilities automatically
snyk fix

GitHub Dependabot

Automated dependency updates:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10

  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"

npm audit (Built-in)

# Check vulnerabilities
npm audit

# Show detailed report
npm audit --json > audit-report.json

# Fix automatically
npm audit fix

# Force fix (may introduce breaking changes)
npm audit fix --force

pip-audit (Python)

# Install
pip install pip-audit

# Scan dependencies
pip-audit

# Check specific requirements file
pip-audit -r requirements.txt

# Output JSON
pip-audit --format json > pip-audit.json

OWASP Dependency-Check

Multi-language dependency scanner:

# Download
wget https://github.com/jeremylong/DependencyCheck/releases/download/v8.0.0/dependency-check-8.0.0-release.zip

# Run scan
./dependency-check/bin/dependency-check.sh \
  --project "MyProject" \
  --scan ./src \
  --format ALL \
  --out ./reports

Integration Scripts

dependency_scan.sh

Automated multi-language dependency scanning:

#!/bin/bash
# Comprehensive dependency vulnerability scan

REPORT_DIR="security-reports/dependencies"
mkdir -p $REPORT_DIR

echo "=== Dependency Vulnerability Scan ==="

# 1. JavaScript/Node.js
if [ -f "package.json" ]; then
    echo "Scanning npm dependencies..."
    npm audit --json > $REPORT_DIR/npm-audit.json || true

    if command -v snyk &> /dev/null; then
        echo "Running Snyk scan..."
        snyk test --json > $REPORT_DIR/snyk-npm.json || true
    fi
fi

# 2. Python
if [ -f "requirements.txt" ] || [ -f "Pipfile" ]; then
    echo "Scanning Python dependencies..."
    pip-audit --format json > $REPORT_DIR/pip-audit.json || true

    if command -v snyk &> /dev/null; then
        echo "Running Snyk scan (Python)..."
        snyk test --file=requirements.txt --json > $REPORT_DIR/snyk-python.json || true
    fi
fi

# 3. Java
if [ -f "pom.xml" ]; then
    echo "Scanning Maven dependencies..."
    mvn dependency:tree > $REPORT_DIR/maven-tree.txt

    if command -v snyk &> /dev/null; then
        echo "Running Snyk scan (Java)..."
        snyk test --file=pom.xml --json > $REPORT_DIR/snyk-java.json || true
    fi
fi

# 4. OWASP Dependency Check
if command -v dependency-check &> /dev/null; then
    echo "Running OWASP Dependency Check..."
    dependency-check --project "MyProject" --scan . --format JSON \
      --out $REPORT_DIR/owasp-dependency-check.json
fi

echo "=== Scan Complete ==="
echo "Reports saved to: $REPORT_DIR/"

analyze_dependencies.py

Parse and prioritize vulnerabilities:

#!/usr/bin/env python3
import json
import sys
from collections import defaultdict

def analyze_npm_audit(json_file):
    """Analyze npm audit results"""
    try:
        with open(json_file) as f:
            data = json.load(f)
    except FileNotFoundError:
        print(f"⚠️  {json_file} not found")
        return {}

    vulnerabilities = data.get('vulnerabilities', {})

    findings = defaultdict(list)
    for pkg, vuln in vulnerabilities.items():
        severity = vuln.get('severity', 'unknown')
        findings[severity].append({
            'package': pkg,
            'severity': severity,
            'via': vuln.get('via', []),
            'range': vuln.get('range', ''),
            'fix_available': vuln.get('fixAvailable', False)
        })

    return findings

def analyze_snyk_results(json_file):
    """Analyze Snyk results"""
    try:
        with open(json_file) as f:
            data = json.load(f)
    except FileNotFoundError:
        print(f"⚠️  {json_file} not found")
        return {}

    vulnerabilities = data.get('vulnerabilities', [])

    findings = defaultdict(list)
    for vuln in vulnerabilities:
        severity = vuln.get('severity', 'unknown')
        findings[severity].append({
            'package': vuln.get('packageName'),
            'version': vuln.get('version'),
            'title': vuln.get('title'),
            'cve': vuln.get('identifiers', {}).get('CVE', []),
            'upgrade': vuln.get('upgradePath', []),
            'exploitMaturity': vuln.get('exploitMaturity', 'unknown')
        })

    return findings

def print_summary(npm_findings, snyk_findings):
    """Print combined summary"""
    print("=== Dependency Vulnerability Summary ===\n")

    all_findings = defaultdict(list)
    for severity in ['critical', 'high', 'medium', 'low']:
        all_findings[severity].extend(npm_findings.get(severity, []))
        all_findings[severity].extend(snyk_findings.get(severity, []))

    for severity in ['critical', 'high', 'medium', 'low']:
        findings = all_findings.get(severity, [])
        if findings:
            print(f"\n{severity.upper()}: {len(findings)} vulnerabilities")
            for finding in findings[:5]:  # Show first 5
                pkg = finding.get('package', 'Unknown')
                title = finding.get('title', 'No description')
                print(f"  • {pkg}: {title[:60]}...")

                if finding.get('fix_available'):
                    print(f"    ✓ Fix available")
                elif finding.get('upgrade'):
                    print(f"    ✓ Upgrade to: {finding['upgrade']}")

                if finding.get('cve'):
                    print(f"    🔗 CVE: {', '.join(finding['cve'][:2])}")

    # Calculate risk score
    score = (
        len(all_findings['critical']) * 10 +
        len(all_findings['high']) * 5 +
        len(all_findings['medium']) * 2 +
        len(all_findings['low']) * 1
    )
    print(f"\n=== Risk Score: {score} (Lower is better) ===")

    if score > 50:
        print("⚠️  HIGH RISK: Immediate action required")
    elif score > 20:
        print("⚠️  MEDIUM RISK: Address soon")
    else:
        print("✓ LOW RISK: Monitor and update regularly")

if __name__ == '__main__':
    npm_findings = analyze_npm_audit('security-reports/dependencies/npm-audit.json')
    snyk_findings = analyze_snyk_results('security-reports/dependencies/snyk-npm.json')
    print_summary(npm_findings, snyk_findings)

update_dependencies.sh

Automated dependency updates:

#!/bin/bash
# Update dependencies with testing

echo "=== Dependency Update Process ==="

# 1. Create backup branch
git checkout -b dependency-update-$(date +%Y%m%d)

# 2. Update npm dependencies
if [ -f "package.json" ]; then
    echo "Updating npm dependencies..."
    npm update
    npm audit fix

    # Run tests
    echo "Running tests..."
    npm test
    if [ $? -ne 0 ]; then
        echo "❌ Tests failed after npm update"
        git checkout main
        exit 1
    fi
fi

# 3. Update Python dependencies
if [ -f "requirements.txt" ]; then
    echo "Updating Python dependencies..."
    pip list --outdated --format=json | \
      jq -r '.[] | "\(.name)==\(.latest_version)"' > requirements.new.txt

    # Test with new versions
    pip install -r requirements.new.txt
    pytest
    if [ $? -eq 0 ]; then
        mv requirements.new.txt requirements.txt
    else
        echo "❌ Tests failed after pip update"
        rm requirements.new.txt
        git checkout main
        exit 1
    fi
fi

# 4. Commit changes
git add package.json package-lock.json requirements.txt
git commit -m "chore: update dependencies

- Updated npm packages
- Updated Python packages
- All tests passing"

echo "✓ Dependencies updated successfully"
echo "Review changes and merge: git checkout main && git merge dependency-update-$(date +%Y%m%d)"

Common Vulnerability Scenarios

1. Outdated Dependencies

{
  "name": "lodash",
  "version": "4.17.15",  // Vulnerable
  "fix": "4.17.21"       // Patched
}

Solution:

npm update lodash
# Or specify version
npm install lodash@4.17.21

2. Transitive Dependencies

app (your code)
  └─ express@4.16.0
      └─ qs@6.5.2 (VULNERABLE!)

Solution:

# Force resolution (npm)
npm install qs@6.11.0

# Or use overrides in package.json
{
  "overrides": {
    "qs": "6.11.0"
  }
}

3. No Fix Available

⚠️  Prototype Pollution in lodash < 4.17.21
    No patch available for dependency tree

Solution:

• Find alternative package
• Vendor and patch manually
• Accept risk (with documentation)
• Refactor to remove dependency

CI/CD Integration

GitHub Actions with Dependabot

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    labels:
      - "dependencies"
      - "security"
    reviewers:
      - "security-team"

  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"

Snyk Monitoring

name: Snyk Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

License Compliance

Check Licenses

# npm
npm install -g license-checker
license-checker --summary

# Python
pip install pip-licenses
pip-licenses --format=markdown > licenses.md

# Output incompatible licenses
license-checker --onlyAllow "MIT;Apache-2.0;BSD-3-Clause;ISC"

Common License Issues

• GPL: Requires source code disclosure
• AGPL: Triggers on network use
• LGPL: Linking requirements
• Commercial: May require purchase

Best Practices

1. Automated Scanning: Run on every commit
2. Dependabot/Renovate: Enable automatic PRs
3. Version Pinning: Use lock files (package-lock.json, Pipfile.lock)
4. Regular Updates: Weekly dependency updates
5. Test Thoroughly: Run full test suite after updates
6. Security Alerts: Configure notifications
7. License Review: Check before adding dependencies
8. Minimal Dependencies: Fewer deps = fewer vulnerabilities
9. Audit New Packages: Check reputation, maintenance
10. Document Exceptions: If can't upgrade, document why

Vulnerability Remediation Priority

Requirements

# Snyk
npm install -g snyk

# npm audit (built-in with npm)

# Python
pip install pip-audit safety

# OWASP Dependency Check
wget https://github.com/jeremylong/DependencyCheck/releases/latest

# License checker
npm install -g license-checker
pip install pip-licenses

Metrics to Track

• Known vulnerabilities: 0 critical, 0 high
• Average age of dependencies: < 6 months
• Update frequency: Weekly
• Time to patch: < 24h for critical
• Dependency count: Minimize
• License compliance: 100%
• False positive rate: < 5%