razbakov/dependency-vuln-report
skills/dependency-vuln-report/SKILL.md
Runs dependency vulnerability scans and produces a complete report with exact installed versions, reason for risk, and remediation priority for each finding. Use when the user asks for dependency scan, npm audit, bun audit, package vulnerabilities, CVE review, or security status of dependencies.
$ install --global
skillsauthnpx skillsauth add razbakov/skills dependency-vuln-reportInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 18, 2026, 5:03 AM34.4s1 file scanned
SKILL.md
- name:
- dependency-vuln-report
- description:
- Runs dependency vulnerability scans and produces a complete report with exact installed versions, reason for risk, and remediation priority for each finding. Use when the user asks for dependency scan, npm audit, bun audit, package vulnerabilities, CVE review, or security status of dependencies.
Dependency Vulnerability Report
Purpose
Generate a vulnerability report where every finding includes:
- package name
- installed version used
- severity
- reason
- priority
- fix status
Do not group findings in a way that hides individual vulnerable packages.
Workflow
- Run audits (production-only):
npm audit --omit=dev --json > /tmp/audit-prod.json
- Resolve exact installed versions from lockfile:
node -e 'const lock=require("./package-lock.json");const a=require("/tmp/audit-prod.json");const pkgs=lock.packages||{};for(const [name,v] of Object.entries(a.vulnerabilities||{})){const key=`node_modules/${name}`;console.log(`${name}|${pkgs[key]?.version||"unknown"}|${v.severity}|${v.isDirect?"direct":"transitive"}|${v.fixAvailable?"fix-available":"no-auto-fix"}`)}'
Priority Rules
Assign one priority per finding:
P0: High/Critical in production runtime with no automatic fix, or severe exploitability in real app paths.P1: High in production with fix available.P2: Moderate direct production dependency, or high dev-only toolchain risk.P3: Moderate transitive risk.P4: Low severity.
When uncertain, prefer the stricter priority and state the assumption.
Required Output Format
Always include:
- Summary counts:
- total
- high / moderate / low / critical
- prod-only counts
- Full finding list (no omissions), sorted by priority then severity:
packageversion usedseveritydirect/transitivereasonpriorityfix availability
- Short remediation plan:
- immediate (P0/P1)
- next (P2)
- backlog (P3/P4)
Reason Writing Rules
Each reason must be one concrete sentence tied to the advisory class, for example:
- open redirect/XSS risk in router navigation handling
- prototype pollution in object mutation helpers
- ReDoS risk in parser/regex path
- dev-server file exposure/bypass in local tooling
Avoid vague reasons like "security issue exists."
Quality Gates
Before finalizing:
- Verify every listed vulnerable package has an explicit version.
- Verify the number of listed findings equals audit total.
- If earlier you grouped packages, provide an expanded per-package list when asked.
Related Skills
razbakov/skills/handoff
tools
VerifiedTrustedCommunity
--- name: handoff description: Get an agent past a browser/UI wall it can't (or must not) cross on its own — a login-gated dashboard, a CAPTCHA, a 2FA prompt, an API that keeps rejecting the write, or an irreversible click that policy says a human must make. This skill is an ESCALATION LADDER, not a first move: it tells you to try the automated browser surfaces FIRST (Chrome-in-Claude, computer-use, an autonomous browser sub-agent) and only fall back to the Handoff app — a wrapper browser that h
3SKILL.mdUpdated Jul 17, 2026
razbakov/summarize-youtube
documentation
VerifiedTrustedCommunity
Summarize one or more YouTube videos from their links. Use this whenever the user pastes a youtube.com or youtu.be URL (or several) and wants to know what it's about — phrasings like "summarize to telegram", "tldr these videos", "what do these say", "summary of this talk", or just dropping links with no instruction at all. Fetches each video's real transcript via yt-dlp (not the page text, which never contains the transcript), cleans the captions, and writes a per-video summary. Default delivery is Telegram; honor any other surface the user names ("to my notes", "just here in chat", "email it"). Trigger even when the user only pastes bare links — bare YouTube links almost always mean "tell me what's in these".
3SKILL.mdUpdated Jun 15, 2026
razbakov/skills/daily-digest
data-ai
VerifiedTrustedCommunity
Daily Digest — Chief-of-Staff role consolidates the six top-managers into one Telegram message to the Commander, instead of six. Implements the protocol from agent-proactivity.md.
3SKILL.mdUpdated Jun 15, 2026
razbakov/instagram-launch-grid
development
VerifiedTrustedCommunity
Seed a new or empty Instagram account with a 9-post grid (3×3) so the profile looks established the moment a new visitor lands. Designed for festivals, new businesses, product launches, conferences, communities — any time an empty IG profile would hurt conversion from external traffic (QR scans, flyer drops, cross-promo). Generates assets via /image-from-gemini (per content-publishing rules — never HTML), writes captions with hashtag sets, and outputs a posting order + cadence plan. Trigger generously: phrases like '9 posts for instagram', 'fill my IG', 'starter grid', 'launch grid', 'instagram seed', '9-post grid', 'IG account not to look empty', 'first instagram posts', 'feed bootstrap', '3x3 grid', 'instagram launch content'. Even if the user mentions only one piece (just the images, just the captions, just the order), use this skill — the grid only works as an integrated bundle.
3SKILL.mdUpdated May 21, 2026