oss-vulnerabilities
Provides a machine-readable knowledge base of the OWASP OSS Top 10 to help developers secure their open source dependencies.
Install
mkdir -p .claude/skills/oss-vulnerabilities && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/10572" && unzip -o skill.zip -d .claude/skills/oss-vulnerabilities && rm skill.zipInstalls to .claude/skills/oss-vulnerabilities
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
OWASP Open Source Software Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in open source software dependencies.Key capabilities
- →Identify open source security risks
- →Assess dependency vulnerability impact
- →Find remediation steps for OSS issues
- →Query vulnerability types and categories
How it works
The skill uses a structured knowledge base derived from the OWASP OSS Top 10 to provide machine-readable references for identifying and fixing dependency-related security risks.
Inputs & outputs
When to use oss-vulnerabilities
- →Identifying unmaintained dependencies
- →Assessing risk of dependency confusion attacks
- →Checking for outdated software
- →Remediating security vulnerabilities
About this skill
OSS Vulnerabilities — Skill Entry
This SKILL.md is the entrypoint for the OSS Vulnerabilities skill.
The skill encodes the OWASP Open Source Software Top 10 as structured, machine-readable references that an agent can query to identify, assess, and remediate risks associated with open source software dependencies.
Normative references (OSS Top 10)
- 00 Vulnerability Index
- 01 Known Vulnerabilities
- 02 Compromise of Legitimate Package
- 03 Name Confusion Attacks
- 04 Unmaintained Software
- 05 Outdated Software
- 06 Untracked Dependencies
- 07 License and Regulatory Risk
- 08 Immature Software
- 09 Unapproved Change
- 10 Under/Over-sized Dependency
Skill layout
SKILL.md— this file (skill entrypoint).references/— the OSS Top 10 normative documents.00-vulnerability-index.md— master index of all vulnerability identifiers, categories, and cross-references.01through10— one document per vulnerability aligned with OWASP OSS Risk numbering.
assets/— reusable format and constants blocks.constants/— vulnerability catalog and category definitions.constants-oss-catalog-v1.0.0.md
formats/— output contract examples.format-vulnerability-assessment-v1.0.0.mdformat-remediation-checklist-v1.0.0.md
Third-Party Attribution
Copyright © OWASP Foundation. OWASP® Open Source Software Top 10 content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://owasp.org/www-project-open-source-software-top-10/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.
When not to use it
- →Proprietary software vulnerability assessment
- →General network security auditing
Limitations
- →Limited to OWASP OSS Top 10 vulnerability types
- →Requires manual dependency input
How it compares
It provides a standardized, agent-consumable framework for OSS-specific risks rather than generic vulnerability scanning.
Compared to similar skills
oss-vulnerabilities side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| oss-vulnerabilities (this skill) | 0 | 4mo | No flags | Intermediate |
| senior-security | 31 | 7mo | Review | Advanced |
| fix-security-vulnerability | 7 | 2mo | Review | Intermediate |
| codebase-cleanup-deps-audit | 2 | 4mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
fix-security-vulnerability
getsentry
Analyze and propose fixes for Dependabot security alerts
codebase-cleanup-deps-audit
sickn33
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
dependency-auditor
alirezarezvani
Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.
security-scanning-security-dependencies
sickn33
You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, assess risks, and recommend remediation.
trivy-offline-vulnerability-scanning
benchflow-ai
Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.