---
name: cve-watch
description: Scans the project's dependency manifests (package.json / requirements.txt / pyproject.toml / Cargo.toml / go.mod / Gemfile / composer.json) for known CVEs via OSV.dev, cross-references the VulnPulse live feed for CVEs published in the last 24 hours, and returns a prioritized patch list. Use this skill when the user asks to "check my dependencies for vulnerabilities", "audit my repo for CVEs", "what should I patch first", "scan for vulns", "security audit my deps", "show me CVEs in this project", or any equivalent ask. Trigger automatically when the user mentions a CVE-by-id (e.g., "is CVE-2026-XXXXX in my code?"). Skip when the user is asking for a static-analysis / linting style audit (different skill).
allowed-tools: Read, Bash, Grep, Glob
---

# CVE Watch — defender-side dependency scan

Scans dependency manifests in the current project and reports prioritized CVEs.

## When to Use This Skill

Invoke automatically when the user asks any of:

- "check my deps for CVEs" / "audit my repo for CVEs"
- "what should I patch first?" / "is my project vulnerable?"
- "is CVE-2026-XXXXX in my code?"
- "security audit my dependencies"
- "scan for vulns"

Skip for: linter/static-analysis requests, license-audit requests, secret-scanner requests
(these are separate skills).

## How It Works

The skill uses **OSV.dev** (Google's Open Source Vulnerability database — free, comprehensive,
no auth required) as the primary backend. It supplements with **VulnPulse**'s live feed
(`vulnpulse.ivixivi.workers.dev/api/digest/latest`) for CVEs published in the last 24h that
may not have propagated to OSV yet.

## Step-by-step

### 1. Detect dependency manifests

Run from the project root:

```bash
ls package.json requirements.txt pyproject.toml Cargo.toml go.mod Gemfile composer.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null
```

Identify which ecosystems are present.

### 2. Run the bundled checker script

```bash
python3 "$(dirname "$0")/scripts/check_deps.py" --root . --output table
```

The script:
- Parses each manifest into `(ecosystem, package, version)` tuples
- Batches a query to `POST https://api.osv.dev/v1/querybatch`
- Returns vulnerabilities grouped by severity
- Adds a "today's CVE" section from VulnPulse cross-reference
- Outputs Markdown table or JSON (via `--output json`)

### 3. Surface the prioritized list

Report in this order:

1. **CRITICAL (CVSS ≥ 9.0)** — patch this hour
2. **HIGH (CVSS 7.0–8.9)** — patch this week
3. **MEDIUM (CVSS 4.0–6.9)** — patch this sprint
4. **LOW** — defer or accept

For each item show:
- CVE ID + CVSS score
- Affected package + version range
- Fixed version (if known)
- One-line impact summary
- Direct link to the OSV / NVD record

### 4. Suggest the patch command

For the top-N most-critical packages, output the exact upgrade command for the user's
ecosystem (e.g., `npm install lodash@^4.17.22`, `pip install --upgrade django>=4.2.7`).

### 5. If "today's CVE" cross-reference returns hits

Highlight separately in a "🔥 Published today" section. These are most-likely-not-yet-in-
your-attention CVEs.

## Output Format

```
## CVE Watch — <date>

Scanned: <ecosystem-list> · <package-count> packages

### 🔴 CRITICAL — patch this hour

| CVE | Package | Current | Fixed | Impact |
|-----|---------|---------|-------|--------|
| CVE-2026-XXXXX (9.8) | foo@1.2.3 | 1.2.3 | 1.2.5 | RCE via crafted input |

### 🟠 HIGH — patch this week

(...)

### 🔥 Published today (cross-referenced from VulnPulse)

(...)

### Recommended patch commands

```bash
npm install foo@^1.2.5
pip install --upgrade bar>=2.0.4
```
```

## Privacy

The script sends only `(ecosystem, package, version)` tuples to OSV.dev. No project source
code or paths leave the machine. OSV.dev is operated by Google's Open Source Security Team.

## Limitations

- Transitive dependencies via lock files are best-effort parsed; if your lock file format
  is exotic the script may miss deeply-nested deps
- Pre-release / git-pinned dependencies are skipped (no version to query)
- VulnPulse cross-reference only covers last 24h; older CVEs come from OSV
- This is a fast triage, not a replacement for `npm audit` / `pip-audit` / `cargo audit` —
  it complements them by adding the VulnPulse "today" layer and a cross-ecosystem unified
  view

## Example Invocation Flow

User: "check my repo for CVEs"

Claude:
1. Detects `package.json` + `requirements.txt`
2. Runs `python3 scripts/check_deps.py --root . --output table`
3. Reads stdout, presents the prioritized table
4. Suggests `npm install ...` and `pip install ...` commands
5. Asks: "Apply these upgrades now?"

## Author

Built by [Anthony Padavano (4444J99)](https://github.com/4444J99). Part of an intelligence
portfolio that includes:

- [VulnPulse](https://vulnpulse.ivixivi.workers.dev) — defender-side CVE feed (used as a backend here)
- [BountyScope](https://bountyscope.ivixivi.workers.dev) — bug-bounty intel + smart-contract analyzer
- [TrendPulse](https://trendpulse.ivixivi.workers.dev) — daily emerging-tech digest
- [PromptScope](https://promptscope.ivixivi.workers.dev), [WriteLens](https://writelens.ivixivi.workers.dev), [EdgarFlash](https://edgarflash.ivixivi.workers.dev)

For freelance security audit work or custom skill development, see
[https://github.com/4444J99](https://github.com/4444J99) — currently taking engagements.