rezkamrezkam/boring-but-good/skills/dependency-track/SKILL.md

dependency-track

Skill1 starsChanged 15 days agoApache-2.0View on GitHub

Query and audit Dependency-Track SCA findings. Use when working with software composition analysis, reviewing vulnerability findings, auditing CVEs, checking project dependency health, uploading SBOMs, or managing policy violations in Dependency-Track.

In this repository19 other files it gives its agents.
- AGENTS.mdAGENTS.md
- ai-chatSkill
- argocdSkill
- code-reviewSkill
- commitSkill
- financeSkill
- handoffSkill
- java-21-to-25-migrationSkill
- jenkinsSkill
- jiraSkill
- perplexitySkill
- pr-readySkill
- researchSkill
- shipSkill
- skanetrafikenSkill
- sonarqubeSkill
- tddSkill
- to-tasksSkill
- verifySkill

The file

We split this skill into the rules it gives an agent

2 rules. About 0 are common, 1 is distinctive, and 1 is very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Very specific:
Run ./setup.sh from the repo root (recommended), or create config files manually:
line 12
Distinctive:
Read references/false-positive-patterns.md when investigating potential false positives from CPE namespace collisions or stale SBOM …
line 125

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

Dependency-Track

Interact with the Dependency-Track SCA platform via its REST API.

Configuration

Run ./setup.sh from the repo root (recommended), or create config files manually:

mkdir -p ~/.boring/dependency-track
echo 'https://your-dtrack-server.example.com' > ~/.boring/dependency-track/url
echo 'your-api-key' > ~/.boring/dependency-track/apikey
chmod 600 ~/.boring/dependency-track/apikey

Obtain an API key: Administration → Access Management → Teams → Generate API key. Required permissions: VIEW_PORTFOLIO, VIEW_VULNERABILITY, VULNERABILITY_ANALYSIS, VIEW_POLICY_VIOLATION.

Scripts

List / search projects

scripts/dtrack-projects.sh [name] [--inactive] [--tag TAG]

Look up project by exact name

scripts/dtrack-project-lookup.sh <name> [version]

Project status and metrics

scripts/dtrack-project-status.sh <project-uuid>

List vulnerability findings

scripts/dtrack-findings.sh <project-uuid> [--suppressed] [--source NVD] [--cve CVE-ID] [--severity CRITICAL]

Each finding includes component.uuid, vulnerability.uuid, and analysis.state — needed for auditing.

Vulnerability details

scripts/dtrack-vulnerability.sh <source> <vuln-id>
# Example: scripts/dtrack-vulnerability.sh NVD CVE-2024-12345

Audit a finding

scripts/dtrack-audit.sh <project> <component> <vulnerability> \
    --state <STATE> [--justification JUST] [--response RESP] \
    [--comment "text"] [--details "text"] [--suppress|--unsuppress]

States: FALSE_POSITIVE, NOT_AFFECTED, RESOLVED, IN_TRIAGE, EXPLOITABLE, NOT_SET

Justifications (pair with FALSE_POSITIVE / NOT_AFFECTED): CODE_NOT_PRESENT, CODE_NOT_REACHABLE, REQUIRES_CONFIGURATION, REQUIRES_DEPENDENCY, REQUIRES_ENVIRONMENT, PROTECTED_BY_COMPILER, PROTECTED_AT_RUNTIME, PROTECTED_AT_PERIMETER, PROTECTED_BY_MITIGATING_CONTROL

Responses (pair with RESOLVED / EXPLOITABLE): UPDATE, ROLLBACK, WORKAROUND_AVAILABLE, WILL_NOT_FIX, CAN_NOT_FIX

Retrieve existing analysis trail

scripts/dtrack-audit-get.sh <project> <component> <vulnerability>

List components / services / violations

scripts/dtrack-components.sh <project-uuid> [page] [--search NAME]
scripts/dtrack-services.sh <project-uuid> [page]
scripts/dtrack-violations.sh <project-uuid> [--suppressed]

Upload BOM (SBOM)

scripts/dtrack-bom-upload.sh <project-uuid> <bom-file> [--auto-create]

Refresh metrics

scripts/dtrack-metrics-refresh.sh [project-uuid]

Raw API

scripts/dtrack-api.sh GET "/v1/project"
scripts/dtrack-api.sh PUT "/v1/analysis" -d '{"project":"...","analysisState":"FALSE_POSITIVE"}'

Typical workflow

S=scripts
$S/dtrack-projects.sh "my-service"
$S/dtrack-project-status.sh <uuid>
$S/dtrack-findings.sh <uuid>
$S/dtrack-vulnerability.sh NVD CVE-2024-XXXXX
$S/dtrack-audit-get.sh <project> <component> <vulnerability>
$S/dtrack-audit.sh <project> <component> <vulnerability> \
    --state FALSE_POSITIVE --justification CODE_NOT_REACHABLE \
    --comment "Vulnerable method is never invoked" --suppress
$S/dtrack-violations.sh <uuid>

False positive patterns

Read references/false-positive-patterns.md when investigating potential false positives from CPE namespace collisions or stale SBOM components.

Links

<DTRACK_URL>/projects/<project-uuid>
<DTRACK_URL>/components/<component-uuid>
<DTRACK_URL>/vulnerabilities/<SOURCE>/<VULN-ID>

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free