security-scan
Fixes npm vulnerabilities found in Snyk reports by patching direct and transitive dependencies.
Install
mkdir -p .claude/skills/security-scan && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/4566" && unzip -o skill.zip -d .claude/skills/security-scan && rm skill.zipInstalls to .claude/skills/security-scan
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Resolve npm dependency vulnerabilities detected by security scans.Key capabilities
- →Parse Snyk vulnerability reports
- →Categorize dependencies as direct or transitive
- →Check npm registry for fixed versions
- →Verify security fixes with build and test commands
How it works
The skill assesses vulnerability reports, explores current dependency versions, applies fixes, and verifies integrity through build and test execution.
Inputs & outputs
When to use security-scan
- →Fixing direct dependency vulnerabilities
- →Resolving transitive dependency security alerts
- →Updating insecure npm packages
- →Verifying security fixes with automated tests
About this skill
Security Scan
Resolve npm dependency vulnerabilities detected by Snyk.io security scans.
Activation Conditions
- User shares Snyk vulnerability reports
- Mentions CVEs/CWEs
- Asks to fix security issues in npm dependencies
Quick Reference
| Action | Rule |
|---|---|
| Fix direct deps | vuln-direct-deps.md |
| Fix transitive deps | vuln-transitive-deps.md |
Workflow
1. Assess
- Parse vulnerability report: package, version, CVE/CWE, severity, fixed version
- Categorize as direct (in package.json) or transitive (pulled in by another package)
2. Explore
- Check
package.jsonfor current versions and existing overrides - Check lockfile for actual resolved versions
- Search source code for direct usage of vulnerable package
- Check npm registry for available fixed versions:
npm view <package> versions --json
3. Fix
See rules for specific fix patterns.
4. Verify
bun i --yarn
bun run type:check
bun run lint
bun run build
bun run test
All must pass.
Tips
- Use exact versions for security fixes (no
^prefix) - Fix Critical/High severity first
- Replace unmaintained packages rather than patching
- Document workarounds with comments explaining why
Rules
See rules/ directory for detailed guidance.
When not to use it
- →Non-npm dependency environments
Limitations
- →Requires all build, lint, and test steps to pass
- →Fixes Critical and High severity issues first
How it compares
It automates the identification and patching workflow compared to manually searching for and updating individual vulnerable packages.
Compared to similar skills
security-scan side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| security-scan (this skill) | 1 | 6mo | Review | Intermediate |
| fix-dependabot-alerts | 18 | 6mo | Review | Intermediate |
| azure-keyvault-keys-ts | 1 | 3mo | Review | Advanced |
| azure-keyvault-secrets-ts | 1 | 3mo | Review | Beginner |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by redpanda-data
View all by redpanda-data →You might also like
fix-dependabot-alerts
microsoft
Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.
azure-keyvault-keys-ts
microsoft
Manage cryptographic keys using Azure Key Vault Keys SDK for JavaScript (@azure/keyvault-keys). Use when creating, encrypting/decrypting, signing, or rotating keys.
azure-keyvault-secrets-ts
microsoft
Manage secrets using Azure Key Vault Secrets SDK for JavaScript (@azure/keyvault-secrets). Use when storing and retrieving application secrets or configuration values.
dependency-upgrade
wshobson
Manage major dependency version upgrades with compatibility analysis, staged rollout, and comprehensive testing. Use when upgrading framework versions, updating major dependencies, or managing breaking changes in libraries.
upgrading-expo
sickn33
Upgrade Expo SDK versions
pnpm
antfu
Node.js package manager with strict dependency resolution. Use when running pnpm specific commands, configuring workspaces, or managing dependencies with catalogs, patches, or overrides.