ns-analyze-vulnerabilities

Analyzes live runtime vulnerabilities in Node.js processes monitored by N|Solid.

6|7|Updated Jun 4, 2026
One-click install
npx skills add https://github.com/nodesource/nsolid-plugin --skill ns-analyze-vulnerabilities-nodesource
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ns-analyze-vulnerabilities
Source: https://github.com/nodesource/nsolid-plugin/tree/main/skills/ns-analyze-vulnerabilities
Command: npx skills add https://github.com/nodesource/nsolid-plugin --skill ns-analyze-vulnerabilities-nodesource

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Static dependency scans cannot tell you which CVEs are actually loaded and exploitable in your running production Node.js applications. This Skill connects to N|Solid to identify real runtime vulnerabilities, trace when they were first detected, and guide remediation. ## Core Features & Use Cases - Runtime Vulnerability Detection: Queries the N|Solid vulnerabilities tool to find CVEs actively loaded by connected Node.js processes across your fleet. - Per-App Package Analysis: Drills into a specific application with application-packages to map vulnerable packages and versions. - First-Detection Timeline: Uses events-historic with the new-vulnerability-found event type to determine when a vulnerability first appeared. - Guided Remediation: Locates the target package.json, proposes patched versions, warns before major upgrades, and verifies fixes by re-scanning. - Use Case: Ask which production apps have critical live CVEs, get a grounded report with evidence and a remediation plan, apply the fix, and confirm resolution. ## Quick Start Ask the assistant to analyze runtime vulnerabilities in your N|Solid-connected Node.js applications and produce a remediation report.

Frequently Asked Questions about ns-analyze-vulnerabilities

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find which CVEs are actually running in my Node.js production apps?▼

Use the N|Solid vulnerabilities tool to list CVEs actively loaded by connected Node.js processes, then drill into a specific app with application-packages to see the exact vulnerable packages and versions.

What is the difference between runtime vulnerability analysis and npm audit?▼

Runtime analysis shows vulnerabilities actually loaded in live processes via N|Solid, while npm audit statically scans project dependencies. For static project dependency scans, use the ns-audit-dependencies skill instead.

How can I find when a vulnerability was first detected in my application?▼

Call the events-historic tool with type 'new-vulnerability-found' plus the app name and time range. Note that 'vulnerability-detected' is not a valid event type despite what some tool descriptions say.

Why does the application-packages call time out during vulnerability analysis?▼

The MCP server allows 180 seconds for this streaming endpoint, but the MCP client may drop after 60 seconds. If it times out, continue the analysis using data already collected from the vulnerabilities tool.

Why do vulnerabilities still appear after I updated the package?▼

Live N|Solid data reflects currently running processes, so verification may require an application restart, redeploy, or package refresh before the updated dependency state appears in the vulnerabilities tool output.