---
name: analyze:dependencies
description: Scan dependencies for CVE vulnerabilities across 11 package managers with fix recommendations
delegates-to: autonomous-agent:orchestrator
---

# Dependency Vulnerability Scanner

Comprehensive dependency vulnerability scanning across 11 package managers and ecosystems, with CVE database integration and automated fix recommendations.

## Usage

```bash
/analyze:dependencies [PATH] [OPTIONS]
```

**Examples**:
```bash
/analyze:dependencies                  # Scan current project
/analyze:dependencies backend/         # Scan specific directory
/analyze:dependencies --critical-only  # Show only critical vulnerabilities
/analyze:dependencies --with-fixes     # Include upgrade recommendations
```

## Supported Ecosystems

### Python (pip, pipenv, poetry)
**Tools**: pip-audit, safety
**Manifests**: requirements.txt, Pipfile, pyproject.toml, poetry.lock

### JavaScript/Node.js (npm, yarn, pnpm)
**Tools**: npm audit, yarn audit, pnpm audit
**Manifests**: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml

### Ruby (bundler)
**Tools**: bundle-audit
**Manifests**: Gemfile, Gemfile.lock

### PHP (composer)
**Tools**: local-php-security-checker
**Manifests**: composer.json, composer.lock

### Go (go modules)
**Tools**: govulncheck
**Manifests**: go.mod, go.sum

### Rust (cargo)
**Tools**: cargo-audit
**Manifests**: Cargo.toml, Cargo.lock

### Java (maven, gradle)
**Tools**: dependency-check
**Manifests**: pom.xml, build.gradle, build.gradle.kts

### .NET (nuget)
**Tools**: dotnet list package --vulnerable
**Manifests**: packages.config, *.csproj

## How It Works

### 1. Ecosystem Detection

Automatically detects package managers:

```
Detecting Ecosystems...
✅ Python (requirements.txt)
✅ JavaScript (package.json, yarn.lock)
✅ Go (go.mod)
```

### 2. Vulnerability Scanning

Runs appropriate scanners for each ecosystem:

```
Scanning Dependencies...
[████████████] Python    (pip-audit)  - 2.3s
[████████████] npm       (npm audit)  - 4.1s
[████████████] Go        (govulncheck) - 1.8s

Results:
✅ Python:     5 vulnerabilities (2 critical)
✅ npm:        12 vulnerabilities (0 critical)
✅ Go:         0 vulnerabilities
```

### 3. Result Aggregation

Deduplicates and synthesizes results:

```
Aggregating Results...
- Total Vulnerabilities: 15 unique
- Duplicates Removed: 2
- Vulnerable Dependencies: 12/187
```

### 4. Risk Assessment

```
Risk Score (0-100) =
    Critical × 25 +
    High × 15 +
    Medium × 8 +
    Low × 3 +
    Info × 1

Example:
- Critical: 2 -> 50 points
- High: 3 -> 45 points
- Medium: 7 -> 56 points
- Low: 3 -> 9 points
---

-----------------------
Total: 160 (capped at 100)
Risk Score: 100/100 (EXTREME)
```

**Risk Levels**:
- 70-100: Extreme/High Risk
- 40-69: Medium Risk
- 0-39: Low Risk

## Output Format

### Terminal Output (Tier 1: Concise Summary)

```
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  DEPENDENCY VULNERABILITY SCAN COMPLETE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🎯 Risk Score: 78/100 (HIGH RISK)

📊 Overview
   Total Vulnerabilities: 15
   Vulnerable Dependencies: 12/187 (6.4%)
   Ecosystems: Python, npm, Go

🚨 Vulnerabilities by Severity
   🔴 Critical: 2
   🟠 High: 3
   🟡 Medium: 7
   🔵 Low: 3
   ⚪ Info: 0

📦 By Ecosystem
   Python: 5 vulnerabilities
   npm: 10 vulnerabilities
   Go: 0 vulnerabilities

[WARN]️  Top 3 Vulnerable Packages
   1. requests (Python) - 2 vulnerabilities
   2. axios (npm) - 3 vulnerabilities
   3. lodash (npm) - 2 vulnerabilities

🔴 Critical Vulnerabilities (2)
   1. CVE-2023-12345 - requests 2.25.1
      SQL injection vulnerability
      Fix: Upgrade to 2.31.0+

   2. CVE-2023-67890 - axios 0.21.1
      Server-side request forgery
      Fix: Upgrade to 1.6.0+

📄 Detailed Report: .data/reports/dependency-scan-2025-01-15.md

⏱️  Scan completed in 8.2s
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
```

### File Report (Tier 2: Comprehensive)

Saved to `.data/reports/dependency-scan-{DATE}.md`:

```markdown
# Dependency Vulnerability Scan Report
**Generated**: 2025-01-15 16:45:23
**Project**: /project
**Risk Score**: 78/100 (HIGH RISK)

---

## Executive Summary

**Total Vulnerabilities**: 15 unique
**Vulnerable Dependencies**: 12 out of 187 total (6.4%)
**Ecosystems Scanned**: Python, npm, Go
**Scan Duration**: 8.2s

**Risk Assessment**: HIGH RISK
- Immediate action required for 2 critical vulnerabilities
- 3 high-severity issues should be addressed soon
- 7 medium-severity issues for next sprint
- 3 low-severity issues can be deferred

---

## Vulnerabilities by Severity

| Severity | Count | Percentage |
|----------|-------|-----------|
| 🔴 Critical | 2 | 13.3% |
| 🟠 High | 3 | 20.0% |
| 🟡 Medium | 7 | 46.7% |
| 🔵 Low | 3 | 20.0% |
| ⚪ Info | 0 | 0.0% |

---

## Vulnerabilities by Ecosystem

### Python (5 vulnerabilities)
- **Critical**: 1
- **High**: 1
- **Medium**: 2
- **Low**: 1

### npm (10 vulnerabilities)
- **Critical**: 1
- **High**: 2
- **Medium**: 5
- **Low**: 2

### Go (0 vulnerabilities)
- No vulnerabilities detected

---

## Top 10 Vulnerable Packages

| Package | Ecosystem | Vulnerabilities | Severity |
|---------|-----------|----------------|----------|
| axios | npm | 3 | 1 Critical, 2 Medium |
| requests | Python | 2 | 1 Critical, 1 High |
| lodash | npm | 2 | 2 Medium |
| urllib3 | Python | 2 | 1 High, 1 Low |
| ws | npm | 1 | 1 High |
| express | npm | 1 | 1 Medium |
| jinja2 | Python | 1 | 1 Medium |
| moment | npm | 1 | 1 Low |
| pyyaml | Python | 1 | 1 Low |
| react-dom | npm | 1 | 1 Medium |

---

## Critical Vulnerabilities (IMMEDIATE ACTION REQUIRED)

### CVE-2023-12345: SQL Injection in requests
**Package**: requests (Python)
**Installed Version**: 2.25.1
**Severity**: 🔴 CRITICAL
**CVSS Score**: 9.8

**Description**:
SQL injection vulnerability in the `requests` library allows remote attackers to execute arbitrary SQL commands via crafted HTTP requests.

**Impact**:
- Database compromise
- Data exfiltration
- Unauthorized access

**CWE**: CWE-89 (SQL Injection)

**Fixed Versions**: 2.31.0, 2.32.0+

**Remediation**:
```bash
# Python (pip)
pip install --upgrade requests>=2.31.0

# Python (poetry)
poetry update requests
```

**References**:
- https://nvd.nist.gov/vuln/detail/CVE-2023-12345
- https://github.com/psf/requests/security/advisories/GHSA-xxxx

---

### CVE-2023-67890: SSRF in axios
**Package**: axios (npm)
**Installed Version**: 0.21.1
**Severity**: 🔴 CRITICAL
**CVSS Score**: 9.1

**Description**:
Server-side request forgery (SSRF) vulnerability allows attackers to make the server perform requests to arbitrary destinations.

**Impact**:
- Internal network scanning
- Access to internal services
- Data exfiltration from internal endpoints

**CWE**: CWE-918 (SSRF)

**Fixed Versions**: 1.6.0+

**Remediation**:
```bash
# npm
npm install axios@latest

# yarn
yarn upgrade axios@latest
```

**References**:
- https://nvd.nist.gov/vuln/detail/CVE-2023-67890
- https://github.com/axios/axios/security/advisories/GHSA-yyyy

---

## High Severity Vulnerabilities

### CVE-2023-11111: XSS in urllib3
**Package**: urllib3 (Python)
**Installed Version**: 1.26.5
**Severity**: 🟠 HIGH
**CVSS Score**: 7.5

**Description**:
Cross-site scripting vulnerability in URL parsing logic.

**Fixed Versions**: 1.26.18+, 2.0.7+

**Remediation**:
```bash
pip install --upgrade urllib3>=1.26.18
```

---

### CVE-2023-22222: DoS in ws
**Package**: ws (npm)
**Installed Version**: 7.4.5
**Severity**: 🟠 HIGH
**CVSS Score**: 7.5

**Description**:
Denial of service vulnerability via regular expression DoS in WebSocket implementation.

**Fixed Versions**: 7.5.10+, 8.17.1+

**Remediation**:
```bash
npm install ws@latest
```

---

### CVE-2023-33333: Path Traversal in express
**Package**: express (npm)
**Installed Version**: 4.17.1
**Severity**: 🟠 HIGH
**CVSS Score**: 7.3

**Description**:
Path traversal vulnerability allows access to files outside webroot.

**Fixed Versions**: 4.19.2+

**Remediation**:
```bash
npm install express@latest
```

---

## Medium Severity Vulnerabilities

[... 7 medium-severity vulnerabilities with similar detail ...]

---

## Low Severity Vulnerabilities

[... 3 low-severity vulnerabilities with similar detail ...]

---

## Upgrade Recommendations

### Python
```bash
# Upgrade all vulnerable packages
pip install --upgrade \
  requests>=2.31.0 \
  urllib3>=1.26.18 \
  jinja2>=3.1.3 \
  pyyaml>=6.0.1

# Or use requirements file
pip install -r requirements-secure.txt
```

**requirements-secure.txt** (generated):
```
requests>=2.31.0
urllib3>=1.26.18
jinja2>=3.1.3
pyyaml>=6.0.1
```

---

### npm
```bash
# Upgrade all vulnerable packages
npm install \
  axios@latest \
  lodash@latest \
  ws@latest \
  express@latest \
  moment@latest \
  react-dom@latest

# Or auto-fix with npm audit
npm audit fix --force
```

---

## Automated Fix Options

### Safe Auto-Upgrades (Recommended)
These upgrades are backward-compatible (semver minor/patch):

```bash
# Python
pip install --upgrade requests urllib3 pyyaml

# npm
npm audit fix
```

### Manual Review Required
These upgrades may have breaking changes (semver major):

- **axios**: 0.21.1 -> 1.6.0 (major version bump)
  - Review: Breaking changes in request config
  - Test: All HTTP client code

- **express**: 4.17.1 -> 4.19.2 (minor bump, but middleware changes)
  - Review: Middleware compatibility
  - Test: All routes and error handlers

---

## Dependency Health Summary

### Total Dependencies: 187

**By Ecosystem**:
- Python: 45 packages
- npm: 142 packages
- Go: 0 packages

**Security Status**:
- ✅ Secure: 175 packages (93.6%)
- [WARN]️  Vulnerable: 12 packages (6.4%)

**Freshness**:
- Up-to-date: 120 packages (64.2%)
- Minor updates available: 45 packages (24.1%)
- Major updates available: 22 packages (11.8%)

---

## License Compliance

**Detected Licenses**:
- MIT: 95 packages
- Apache-2.0: 32 packages
- BSD-3-Clause: 18 packages
- ISC: 25 packages
- GPL-3.0: 2 packages [WARN]️ (Review required)
- Unknown: 15 packages [WARN]️ (Investigate)

---

## Risk Score Breakdown

```
Component Scores:
- Critical Vulnerabilities (2 × 25): 50 points
- High Vulnerabilities (3 × 15): 45 points
- Medium Vulnerabilities (7 × 8): 56 points
- Low Vulnerabilities (3 × 3): 9 points
--------------------------------------------
Total: 160 points (capped at 100)

Final Risk Score: 100/100 -> Normalized: 78/100
```

**Risk Level**: 🔴 HIGH RISK

**Mitigation**:
1. Fix 2 critical vulnerabilities immediately
2. Fix 3 high vulnerabilities within 48 hours
3. Schedule medium vulnerabilities for next sprint
4. Low vulnerabilities can be deferred

**Estimated Time to Secure**:
- Critical fixes: 2-4 hours
- High fixes: 4-6 hours
- Testing: 8-12 hours
- **Total**: 1-2 days

---

## Action Plan

### Phase 1: Emergency Fixes (Today)
1. Upgrade `requests` to 2.31.0+ (30 min)
2. Upgrade `axios` to 1.6.0+ (45 min + testing)
3. Run test suite (30 min)
4. Deploy hotfix (30 min)

**Total**: 2-3 hours

### Phase 2: High Priority (This Week)
1. Upgrade `urllib3`, `ws`, `express` (2 hours)
2. Run comprehensive tests (4 hours)
3. QA validation (2 hours)
4. Deploy to production (1 hour)

**Total**: 9 hours

### Phase 3: Medium Priority (Next Sprint)
1. Upgrade remaining 7 packages (3 hours)
2. Testing (4 hours)
3. Documentation updates (1 hour)

**Total**: 8 hours

---

## Continuous Monitoring

**Recommendations**:
1. **CI/CD Integration**: Add dependency scanning to pipeline
2. **Weekly Scans**: Schedule automated vulnerability scans
3. **Dependency Updates**: Review updates monthly
4. **Security Alerts**: Subscribe to security advisories

**GitHub Actions Example**:
```yaml
name: Dependency Scan
on:
  schedule:
    - cron: '0 0 * * 0'  # Weekly
  pull_request:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Scan Dependencies
        run: /analyze:dependencies --format=sarif --output=results.sarif
      - name: Upload Results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif
```

---

## Next Steps

1. ✅ **Review this report** with development team
2. [WARN]️  **Create tickets** for each critical/high vulnerability
3. [WARN]️  **Schedule fixes** according to action plan
4. [WARN]️  **Set up CI/CD** scanning for future PRs
5. [WARN]️  **Subscribe** to security advisories for critical packages

---

**End of Report**
```

## Advanced Features

### Critical-Only Mode

```bash
/analyze:dependencies --critical-only
```

Shows only critical vulnerabilities for rapid triage.

### With Fix Recommendations

```bash
/analyze:dependencies --with-fixes
```

Includes detailed upgrade commands and compatibility notes.

### JSON Output for CI/CD

```bash
/analyze:dependencies --format=json --output=scan-results.json
```

Machine-readable format for automation.

### SARIF Output

```bash
/analyze:dependencies --format=sarif
```

Standard format for security tools integration.

## Integration with Learning System

The dependency scanner integrates with pattern learning:

```python
# After each scan
learning_engine.store_pattern({
    "task_type": "dependency_scan",
    "context": {
        "ecosystems": ["python", "npm"],
        "total_dependencies": 187,
        "vulnerable_count": 12
    },
    "outcome": {
        "risk_score": 78,
        "critical_count": 2,
        "high_count": 3
    },
    "trends": {
        "risk_score_delta": -5,  # Improved from last scan
        "new_vulnerabilities": 3,
        "fixed_vulnerabilities": 8
    }
})
```

## Performance Expectations

| Ecosystem | Dependencies | Scan Time |
|-----------|-------------|-----------|
| Python | <50 | 5-15s |
| Python | 50-200 | 15-45s |
| npm | <100 | 10-30s |
| npm | 100-500 | 30-90s |
| Go | <50 | 5-10s |
| Rust | <50 | 10-20s |
| Multi | Mixed | 30-120s |

## Best Practices

1. **Scan Before Deploy**: Always scan before production deployment
2. **Fix Critical First**: Prioritize by severity and exploitability
3. **Test After Upgrade**: Run full test suite after security updates
4. **Monitor Trends**: Track risk score over time
5. **Automate Scanning**: Integrate into CI/CD pipeline
6. **Stay Updated**: Review security advisories weekly
7. **Document Decisions**: Record why certain vulnerabilities are accepted

---

This command provides comprehensive dependency vulnerability scanning with minimal setup and maximum actionable insight.