From bitwarden-security-engineer
This skill should be used when the user asks to "review Dependabot alerts", "check for vulnerable dependencies", "audit third-party packages", "assess supply chain risk", "run Grype scan", or needs to evaluate dependency health, transitive risk, or supply chain security.
npx claudepluginhub bitwarden/ai-plugins --plugin bitwarden-security-engineerThis skill uses the workspace's default tool permissions.
```bash
Scans project dependencies across ecosystems for vulnerabilities, generates SBOMs, assesses risks, and provides automated remediation strategies. Useful for auditing packages, license compliance, and supply chain security.
Scans project dependencies across ecosystems for vulnerabilities and license risks, generates SBOMs, assesses supply chain security, and recommends remediation.
Scans project dependencies for vulnerabilities, outdated packages, abandoned libraries, and supply chain risks across npm/Yarn/pnpm, pip/Poetry/Pipenv, Cargo, Go, and Bundler ecosystems.
Share bugs, ideas, or general feedback.
# List all open Dependabot alerts sorted by severity
gh api /repos/{owner}/{repo}/dependabot/alerts --jq '.[] | select(.state == "open") | {number, severity: .security_vulnerability.severity, package: .security_vulnerability.package.name, ecosystem: .security_vulnerability.package.ecosystem, summary: .security_advisory.summary}'
# Filter by severity
gh api "/repos/{owner}/{repo}/dependabot/alerts?severity=critical&state=open"
# Get full details for a specific alert
gh api /repos/{owner}/{repo}/dependabot/alerts/{alert_number}
For each alert, determine:
| Situation | Action |
|---|---|
| Fix available, minor version bump | Update immediately |
| Fix available, major version bump | Evaluate breaking changes, schedule update |
| No fix available, code path reachable | Implement workaround or replace dependency |
| No fix available, code path not reachable | Document and monitor, set review date |
| Vulnerability in transitive dependency | Use overrides/resolutions to pin fixed version |
Direct dependencies are visible in package.json or .csproj files, but transitive dependencies (dependencies of dependencies) make up the majority of the dependency tree and are often invisible.
Why transitive dependencies matter:
How to investigate:
# npm: Show full dependency tree
npm ls --all
# npm: Find which direct dependency pulls in a vulnerable transitive
npm ls <vulnerable-package>
# .NET: List all vulnerable packages including transitive
dotnet list package --vulnerable --include-transitive
# .NET: Show dependency graph
dotnet list package --include-transitive
When evaluating whether to adopt or keep a dependency, assess:
| Criterion | Green Flag | Red Flag |
|---|---|---|
| Maintenance | Regular commits, responsive to issues | No commits in 12+ months, unresponded issues |
| Vulnerability History | Few CVEs, quick patches | Repeated CVEs, slow response |
| Maintainer Count | Multiple active maintainers | Single maintainer, bus factor of 1 |
| Community | High download count, active users | Very low adoption for claimed scope |
| License | Compatible with project (MIT, Apache-2.0) | Restrictive or ambiguous license |
| Security Practices | Signed releases, security policy, 2FA | No security policy, no signed releases |
Grype scans container images and filesystems for known vulnerabilities:
# Scan a container image
grype <image>:<tag>
# Scan a directory
grype dir:/path/to/project
# Output as JSON for programmatic processing
grype <image> -o json
# Filter by severity
grype <image> --only-fixed --fail-on high
Interpreting Grype output:
Fixed column indicates whether an update is available--only-fixed to focus on actionable items (vulnerabilities with available fixes)# Check for vulnerable packages
dotnet list package --vulnerable
# Include transitive dependencies
dotnet list package --vulnerable --include-transitive
# Check for outdated packages
dotnet list package --outdated
NuGet-specific concerns:
PackageReference in .csproj is preferred over packages.config for better transitive resolutionDirectory.Packages.props for centralized version management in multi-project solutions# Run security audit
npm audit
# Auto-fix where possible
npm audit fix
# Force fixes (may introduce breaking changes)
npm audit fix --force
# Check lockfile integrity
npm ci # Installs exactly from lockfile, fails if lockfile is out of date
npm-specific concerns:
package-lock.json must be committed and kept in syncoverrides in package.json to force transitive dependency versions:
{
"overrides": {
"vulnerable-package": ">=2.0.0"
}
}
postinstall scripts in dependencies — they execute arbitrary code during npm installA Software Bill of Materials (SBOM) is an inventory of all components in a software artifact. Understanding SBOMs helps reason about supply chain risk:
package-lock.json, packages.lock.json). Use npm ci in CI/CD, not npm install.