depscan

What problem does it solve?

This Skill addresses the critical need for comprehensive Software Composition Analysis (SCA) by identifying vulnerabilities, managing licenses, and generating essential security documents like SBOMs and VEX.

Core Features & Use Cases

• Advanced SCA: Goes beyond basic dependency scanning to include vulnerability data, license compliance, and risk assessment.
• SBOM & VEX Generation: Creates Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) documents crucial for supply chain security and compliance.
• Use Case: A development team needs to ensure their new application is free from known vulnerabilities in its open-source dependencies and must provide an SBOM to their security team. This Skill can perform the scan, generate the SBOM, and highlight critical vulnerabilities with actionable remediation steps.

Quick Start

Run a full OWASP Depscan audit on the current project directory, generating SARIF, JSON, and HTML reports, and enabling risk auditing and license scanning.