sca-audit

Scan project dependencies for known vulnerabilities (CVEs). Use when reviewing dependency files (package.json, requirements.txt, go.mod, pom.xml, Gemfile, Cargo.toml, etc.), triaging Dependabot/Renovate alerts, or performing pre-deployment security checks.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, well-structured procedure with executable scanner commands, but it is weakened by a batch workflow that lacks validation/feedback checkpoints and by two file references that point to non-existent bundle files.

Suggestions

Add a validation/feedback checkpoint after the scan step (e.g., confirm the scanner exited 0 and produced findings, and retry/handle empty or errored output before analyzing) to satisfy the batch-operation feedback-loop requirement.

Either provide the referenced plays/sca-audit.md and templates/finding.md bundle files or inline their essential content so the procedure is self-contained and navigation resolves.

Make the Analyze Results and Dependency Health steps more actionable with concrete commands or decision rules instead of abstract directives like 'determine reachability' and 'flag unmaintained packages'.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence — it never explains what a CVE or dependency is, and every line (tool preference order, output spec, OWASP refs) earns its place, matching the lean-and-efficient anchor.	5 / 5
Actionability	Provides copy-paste-ready scan commands (osv-scanner, npm audit, pip-audit, govulncheck, trivy) but the Analyze Results and Dependency Health steps stay abstract ('determine reachability', 'flag unmaintained packages') and the referenced templates/finding.md does not exist, leaving minor gaps.	4 / 5
Workflow Clarity	Steps are clearly numbered 1-4, but this is a batch operation (50+ dependencies) with no validation or feedback loop — no checkpoint confirming the scan succeeded or handling scanner failure/empty output — so per the batch-operation cap workflow clarity cannot exceed 3.	3 / 5
Progressive Disclosure	Section structure (Steps, Output, OWASP References) is reasonable and references are clearly signaled with inline code paths, but both referenced files (plays/sca-audit.md, templates/finding.md) are absent from the bundle, so the one-level-deep navigation does not actually resolve.	3 / 5
	Total	15 / 20 Passed

Description

90%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-formed description with explicit what/when structure, third-person voice, and rich natural trigger terms. Its only limitation is that it names a single capability (scanning) rather than enumerating several distinct actions.

Dimension	Reasoning	Score
Specificity	Names the domain (dependency vulnerability scanning) and one concrete action ('Scan project dependencies for known vulnerabilities (CVEs)'), but lists only that single action rather than several specific capabilities, matching the anchor that names a domain plus 1-2 actions.	3 / 5
Completeness	Explicitly answers both 'what' ('Scan project dependencies for known vulnerabilities (CVEs)') and 'when' ('Use when reviewing dependency files..., triaging Dependabot/Renovate alerts, or performing pre-deployment security checks') with concrete trigger phrases, matching the top anchor exactly.	5 / 5
Trigger Term Quality	Comprehensive natural-term coverage including concrete manifest filenames (package.json, requirements.txt, go.mod, pom.xml, Gemfile, Cargo.toml), tool names users actually say (Dependabot/Renovate alerts), and 'CVEs'/'pre-deployment security checks', matching the comprehensive-synonyms-and-extensions anchor.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (SCA/CVE dependency auditing) with distinct triggers (specific manifest files, Dependabot/Renovate alerts) that are unlikely to fire for unrelated skills, matching the clear-niche-minimal-conflict anchor.	5 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: OWASP/secure-agent-playbook
Path: plugins/code-security-skills/skills/sca-audit/SKILL.md
Commit: 79fea6b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.