What problem does it solve? Manually tracking vulnerabilities across NuGet packages and Aspire-managed container components is slow and error-prone, and raw scanner output rarely tells you whether a CVE is actually reachable in your code. This Skill automates the full dependency CVE review and adds a reachability judgment for each match. ## Core Features & Use Cases - Dependency Inventory: Enumerates NuGet packages and Aspire-managed container/infrastructure components, flagging which ones ship in the runtime versus build-only tooling. - OSV.dev Cross-Reference: Queries the OSV.dev API for known vulnerabilities matching each inventoried component and version. - Reachability Assessment: Analyzes how the application actually uses each vulnerable dependency and classifies findings as reachable, not-reachable, or unknown. - Persistent Findings & Reports: Stores findings in a structured findings store, auto-resolves findings when packages are patched, and renders a dated snapshot plus a cross-capability report. - Use Case: Before a release, run a full dependency review to get a report showing every CVE match with severity and reachability, so the team patches only what actually matters first. ## Quick Start Ask the assistant to run a dependency CVE review of this repository against OSV.dev and show the findings with reachability.
