sca-runner

naporin0624's avatarfrom naporin0624

Runs Software Composition Analysis (SCA) to detect vulnerable dependencies. Wraps npm audit and Trivy fs. Use when user asks to "scan dependencies", "check npm vulnerabilities", "SCA scan", "dependency audit", "依存関係スキャン", "脆弱性チェック".

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 26, 2025
[Security Operations]

When & Why to Use This Skill

The SCA Runner is a specialized Software Composition Analysis (SCA) tool designed to automate the detection of security vulnerabilities within project dependencies. By wrapping industry-standard scanners like npm audit and Trivy, it provides a unified interface for identifying CVEs across multiple programming languages including Node.js, Python, Go, and Java, ensuring a secure software supply chain and proactive risk management.

Use Cases

  • Automated Dependency Auditing: Quickly scan Node.js projects using npm audit to identify and remediate known vulnerabilities in package-lock.json.
  • Multi-Language Security Scanning: Leverage Trivy integration to perform comprehensive security checks on repositories containing Python, Go, Ruby, Rust, Java, or .NET code.
  • Vulnerability Risk Assessment: Detect and categorize critical security threats such as Prototype Pollution, Path Traversal, and Code Injection before they reach production.
  • Security Compliance Reporting: Generate detailed JSON-formatted scan results to facilitate security audits, compliance documentation, and automated remediation workflows.
namesca-runner
descriptionRuns Software Composition Analysis (SCA) to detect vulnerable dependencies. Wraps npm audit and Trivy fs. Use when user asks to "scan dependencies", "check npm vulnerabilities", "SCA scan", "dependency audit", "依存関係スキャン", "脆弱性チェック".

SCA Runner

Wrapper for npm audit and Trivy to perform Software Composition Analysis.

Prerequisites

At least one of these tools must be installed:

# npm audit (built into npm)
npm --version

# Trivy (recommended for multi-language support)
brew install trivy
# or
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

Usage

# Scan with auto-detection (prefers Trivy if available)
npx sca-runner .

# Force specific scanner
npx sca-runner . --scanner npm
npx sca-runner . --scanner trivy

# JSON output
npx sca-runner . --json

# Check available scanners
npx sca-runner --check

# Scan specific package file
npx sca-runner ./package-lock.json --scanner npm

Supported Package Managers

Scanner Languages/Files
npm audit Node.js (package-lock.json)
Trivy Node.js, Python, Go, Ruby, Rust, Java, .NET

Output Format

{
  "tool": "trivy",
  "scanPath": ".",
  "scanDate": "2024-01-15T10:30:00Z",
  "findings": [
    {
      "id": "CVE-2024-1234",
      "severity": "critical",
      "package": "lodash",
      "installedVersion": "4.17.20",
      "fixedVersion": "4.17.21",
      "title": "Prototype Pollution",
      "description": "...",
      "cvss": 9.8,
      "cwes": ["CWE-1321"],
      "references": ["https://nvd.nist.gov/..."]
    }
  ],
  "summary": {
    "total": 5,
    "critical": 1,
    "high": 2,
    "medium": 1,
    "low": 1
  }
}

Exit Codes

  • 0: No vulnerabilities found
  • 1: Vulnerabilities detected
  • 2: Tool not installed or error

Common CVEs Detected

  • Prototype Pollution (CWE-1321)
  • Regular Expression DoS (CWE-1333)
  • Path Traversal (CWE-22)
  • Code Injection (CWE-94)
  • Denial of Service (CWE-400)