Dependency-manifest CVE scanning for Claude Code, backed by Spidercob's dep-scanner (osv-scan on PyPI) and the free OSV.dev database. No API key, no signup.
/plugin marketplace add SpiderCob/dep-scan-plugin
/plugin install dep-scan@dep-scan
Adds a dep-scan skill: point it at a manifest (requirements.txt, package.json, package-lock.json, go.mod, Cargo.toml, pom.xml) or let it auto-detect one in the project root, and it reports known CVEs grouped by severity with suggested fix versions.
For CI enforcement, see osv-scan-action.
Apache-2.0