@softspark/ai-toolkit 1.3.13 → 1.3.14

package/CHANGELOG.md

@@ -7,6 +7,28 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v1.3.14 — CVE Scanner + Open Contributions (2026-04-08)
+
+### Added
+- **`/cve-scan` skill** — auto-detect project ecosystems (npm, pip, composer, cargo, go, ruby, dart) and scan dependencies for known CVEs using native audit tools. Includes `cve_scan.py` scanner script with parsers for npm and pip-audit, unified severity report, `--fix` and `--json` modes.
+- **CVE scan in security-auditor agent** — `/cve-scan` is now a mandatory first step in the OWASP A06 (Vulnerable Components) checklist.
+- **CVE scan in `/workflow security-audit`** — security-auditor agent runs CVE scan as part of the parallel audit phase.
+- **`security-audit` CI job** — `audit_skills.py --ci` now runs in GitHub Actions pipeline.
+- **`CODE_OF_CONDUCT.md` in CI** — added to required files check.
+- **`.github/CODEOWNERS`** — auto-assigns maintainer for review.
+- **`.github/FUNDING.yml`** — GitHub Sponsors configuration.
+- **GitHub Security Advisories** — added CVE/advisory procedure to `SECURITY.md`.
+- **Open contribution workflow** — full `CONTRIBUTING.md` rewrite (fork, branch naming, commit conventions, CI requirements), PR checklist template, blank issues enabled.
+
+### Removed
+- **`close-prs.yml`** — removed auto-close workflow to accept external PRs.
+
+### Fixed
+- **Copyright** — `LICENSE` updated from `2024-present` to `2024-2026`.
+- **`SECURITY.md`** — removed duplicate Scope section.
+
+---
+
 ## v1.3.13 — CLI --version flag (2026-04-08)
 
 ### Added

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024-present Lukasz Krzemien (biuro@softspark.eu)
+Copyright (c) 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,10 +1,10 @@
 # ai-toolkit
 
-> Professional-grade AI coding toolkit with multi-platform support. Machine-enforced safety, 90 skills, 44 agents, expanded lifecycle hooks, persona presets, experimental opt-in plugin packs, and benchmark tooling — works with Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, and Augment, ready in 60 seconds.
+> Professional-grade AI coding toolkit with multi-platform support. Machine-enforced safety, 91 skills, 44 agents, expanded lifecycle hooks, persona presets, experimental opt-in plugin packs, and benchmark tooling — works with Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, and Augment, ready in 60 seconds.
 
 [![CI](https://github.com/softspark/ai-toolkit/actions/workflows/ci.yml/badge.svg)](https://github.com/softspark/ai-toolkit/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Skills](https://img.shields.io/badge/skills-90-brightgreen)](app/skills/)
+[![Skills](https://img.shields.io/badge/skills-91-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-44-blue)](app/agents/)
 [![Tests](https://img.shields.io/badge/tests-377%20passing-success)](tests/)
 
@@ -21,7 +21,7 @@ ai-toolkit install
 npx @softspark/ai-toolkit install
 ```
 
-**That's it.** Claude Code picks up 90 skills, 44 agents, quality hooks, and the safety constitution automatically.
+**That's it.** Claude Code picks up 91 skills, 44 agents, quality hooks, and the safety constitution automatically.
 
 ### Update
 
@@ -134,7 +134,7 @@ Replaces all symlinks with real files, inlines rules into CLAUDE.md, copies cons
 | Component | Count | Description |
 |-----------|-------|-------------|
 | `skills/` (task) | 28 | Slash commands: `/commit`, `/build`, `/deploy`, `/test`, `/skill-audit`, ... |
-| `skills/` (hybrid) | 30 | Slash commands with agent knowledge base |
+| `skills/` (hybrid) | 31 | Slash commands with agent knowledge base |
 | `skills/` (knowledge) | 32 | Domain knowledge auto-loaded by agents |
 | `agents/` | 44 | Specialized agents across 10 categories |
 | `hooks/` | 21 global + 5 skill-scoped | Quality gates, path safety, CLAUDE.md enforcement, notifications, prompt governance, subagent lifecycle, session-end handoff, usage tracking, config protection, MCP health, governance audit |
@@ -156,7 +156,7 @@ ai-toolkit/
 │   │   ├── backend-specialist.md
 │   │   ├── security-architect.md
 │   │   └── ... (41 more)
-│   ├── skills/          # 90 skills (task / hybrid / knowledge)
+│   ├── skills/          # 91 skills (task / hybrid / knowledge)
 │   │   ├── commit/      # /commit slash command
 │   │   ├── review/      # /review slash command
 │   │   ├── clean-code/  # knowledge skill (auto-loaded)
@@ -223,6 +223,7 @@ ai-toolkit/
 | `/agent-creator` | Scaffold a new specialized agent with tools and trigger guidance | high |
 | `/plugin-creator` | Scaffold an experimental plugin pack with manifest and optional modules | high |
 | `/skill-audit` | Scan skills/agents for security risks: dangerous patterns, secrets, permissions | medium |
+| `/cve-scan` | Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, ruby, dart) | medium |
 | `/analyze` | Code quality, complexity, and pattern analysis | medium |
 | `/fix` | Auto-fix lint/type errors | low |
 | `/build` | Build with issue detection | low |
@@ -329,25 +330,28 @@ Hook logic lives in `app/hooks/*.sh` — not inline JSON one-liners. Scripts are
 | `/migrate` | Pre | Backup verification |
 | `/rollback` | Post | State verification |
 
-### 3. Skill Security Auditing
+### 3. Security Scanning
 
-Scan all skills and agents for security risks — both interactively and in CI:
+Two complementary security tools:
+
+**`/skill-audit`** — scan skills and agents for code-level risks:
 
 ```bash
-# Interactive (Claude provides remediation suggestions)
-/skill-audit
+/skill-audit                              # Interactive (Claude remediation)
+python3 scripts/audit_skills.py --ci      # CI mode: exit 1 on HIGH
+```
+
+Detects: `eval()`/`exec()`, hardcoded secrets, permission issues, bash risks.
 
-# Deterministic Python scanner for CI pipelines
-python3 scripts/audit_skills.py           # human-readable report
-python3 scripts/audit_skills.py --json    # machine-readable JSON
-python3 scripts/audit_skills.py --ci      # exit 1 on any HIGH finding
+**`/cve-scan`** — scan project dependencies for known CVEs:
+
+```bash
+/cve-scan                                 # Auto-detect ecosystems, scan all
+python3 app/skills/cve-scan/scripts/cve_scan.py          # Direct invocation
+python3 app/skills/cve-scan/scripts/cve_scan.py --json   # Machine-readable
 ```
 
-**What it detects:**
-- Dangerous code: `eval()`, `exec()`, `subprocess(shell=True)`, `pickle.loads`
-- Hardcoded secrets: AWS keys, GitHub PATs, private keys, API tokens
-- Permission issues: knowledge skills with Bash, missing `allowed-tools`
-- Bash risks: `curl | bash`, `chmod 777`, unquoted variables
+Supports: npm, pip, composer, cargo, go, ruby, dart. Uses native audit tools — zero external deps.
 
 **Severity levels:** HIGH (blocks CI), WARN (should fix), INFO (review)
 

package/app/ARCHITECTURE.md

@@ -134,7 +134,7 @@ Universal multi-agent system for software development. Works across all reposito
 | `prd-to-issues` | `/prd-to-issues` | Break PRD into GitHub issues with vertical slices and HITL/AFK tagging |
 | `skill-audit` | `/skill-audit` | Scan skills and agents for security risks, dangerous patterns, secrets |
 
-### Hybrid Skills (30)
+### Hybrid Skills (31)
 | Skill | Slash Command | Purpose |
 |-------|---------------|---------|
 | `explore` | `/explore` | Codebase exploration and tech stack discovery |
@@ -143,6 +143,7 @@ Universal multi-agent system for software development. Works across all reposito
 | `plan` | `/plan` | Create structured plan with task breakdown |
 | `refactor` | `/refactor` | Plan and execute code refactoring with safety checks |
 | `analyze` | `/analyze` | Analyze code quality, complexity, and patterns |
+| `cve-scan` | `/cve-scan` | Scan project dependencies for CVEs using native tools (npm, pip, composer, cargo, go, ruby, dart) |
 | `docs` | `/docs` | Generate/update documentation (README, API docs, architecture notes) |
 | `search` | `/search` | Search knowledge base (MCP + local fallback) |
 | `explain` | `/explain` | Explain file/module architecture with Mermaid diagrams |

package/app/agents/security-auditor.md

@@ -63,7 +63,7 @@ hybrid_search_kb(query="vulnerability {type}", limit=10)
 - [ ] Unnecessary features disabled
 
 ### A06:2021 - Vulnerable Components
-- [ ] Dependencies scanned for CVEs
+- [ ] Dependencies scanned for CVEs — **run `/cve-scan` or `python3 ${SKILL_DIR}/cve-scan/scripts/cve_scan.py`**
 - [ ] Components up to date
 - [ ] SBOM maintained
 
@@ -91,6 +91,21 @@ hybrid_search_kb(query="vulnerability {type}", limit=10)
 
 ## Security Audit Commands
 
+### Dependency CVE Scan (MANDATORY — run FIRST)
+
+```bash
+# Auto-detect ecosystems and scan all dependencies for CVEs
+python3 app/skills/cve-scan/scripts/cve_scan.py
+
+# JSON output for structured analysis
+python3 app/skills/cve-scan/scripts/cve_scan.py --json
+
+# Or use the skill interactively
+/cve-scan
+```
+
+### Code & Infrastructure Scans
+
 ```bash
 # Check for secrets in code
 docker exec {app-container} gitleaks detect --source=/app

package/app/skills/cve-scan/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: cve-scan
+description: "Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, bundler, dart)"
+user-invocable: true
+effort: medium
+argument-hint: "[--ecosystem npm|pip|composer|cargo|go|ruby|dart] [--fix] [--json]"
+allowed-tools: Read, Grep, Glob, Bash
+---
+
+# /cve-scan - Dependency CVE Scanner
+
+$ARGUMENTS
+
+Detect project ecosystems and scan dependencies for known vulnerabilities using native audit tools. Zero external dependencies — uses tools already installed in the project environment.
+
+## Usage
+
+```
+/cve-scan                        # Auto-detect all ecosystems, scan all
+/cve-scan --ecosystem npm        # Force specific ecosystem
+/cve-scan --fix                  # Auto-fix where possible (npm audit fix, etc.)
+/cve-scan --json                 # Machine-readable JSON output
+```
+
+## What This Command Does
+
+1. **Detect** package managers by lock/manifest files in the project
+2. **Run** the native audit command for each detected ecosystem
+3. **Parse** results into a unified severity-based report
+4. **Report** CVE IDs, affected packages, installed vs fixed versions, advisory links
+5. **Fix** automatically when `--fix` is passed (where the tool supports it)
+
+## Ecosystem Detection & Commands
+
+| Manifest File | Lock File | Ecosystem | Audit Command | CVE Database |
+|---------------|-----------|-----------|---------------|--------------|
+| `package.json` | `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` | npm/yarn/pnpm | `npm audit --json` / `yarn audit --json` / `pnpm audit --json` | GitHub Advisory DB |
+| `requirements.txt` / `pyproject.toml` / `setup.py` | `requirements.txt` | pip | `pip-audit --format=json` | OSV / PyPI Advisory |
+| `composer.json` | `composer.lock` | composer | `composer audit --format=json` | Packagist / FriendsOfPHP |
+| `Cargo.toml` | `Cargo.lock` | cargo | `cargo audit --json` | RustSec Advisory DB |
+| `go.mod` | `go.sum` | go | `govulncheck ./...` | Go Vulnerability DB |
+| `Gemfile` | `Gemfile.lock` | bundler | `bundle-audit check` | Ruby Advisory DB |
+| `pubspec.yaml` | `pubspec.lock` | dart/flutter | `dart pub outdated --json` | pub.dev |
+
+## Steps
+
+1. **Detect ecosystems**: Glob for manifest/lock files at project root and common subdirectories
+2. **Check tool availability**: Verify audit tool is installed for each detected ecosystem
+3. **Run audit**: Execute native audit command, capture JSON output where available
+4. **Parse results**: Extract CVE ID, package name, installed version, fixed version, severity, advisory URL
+5. **Unified report**: Merge all ecosystems into single report sorted by severity
+6. **Fix mode**: If `--fix` passed, run `npm audit fix`, `pip-audit --fix`, `cargo audit fix` etc.
+7. **Exit code**: Non-zero if any CRITICAL or HIGH vulnerabilities found
+
+## Detection Script
+
+Run the bundled detection script to quickly identify ecosystems and tool availability:
+
+```bash
+python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py
+```
+
+Options:
+```bash
+python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --json      # JSON output
+python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --fix        # Auto-fix mode
+python3 ${CLAUDE_SKILL_DIR}/scripts/cve_scan.py --ecosystem npm  # Specific ecosystem
+```
+
+## Output Format
+
+```markdown
+## CVE Scan Report
+
+### Ecosystems Detected
+- npm (package-lock.json) — `npm audit` available ✓
+- pip (requirements.txt) — `pip-audit` not installed ⚠️
+
+### Summary
+| Severity | Count |
+|----------|-------|
+| CRITICAL | 1 |
+| HIGH | 3 |
+| MEDIUM | 5 |
+| LOW | 2 |
+
+### Findings
+
+#### [CRITICAL] lodash@4.17.20 (npm)
+- **CVE**: CVE-2021-23337
+- **Title**: Prototype Pollution
+- **Fixed in**: 4.17.21
+- **Advisory**: https://github.com/advisories/GHSA-35jh-r3h4-6jhm
+
+#### [HIGH] django@3.2.0 (pip)
+- **CVE**: CVE-2023-36053
+- **Title**: Potential ReDoS in EmailValidator
+- **Fixed in**: 3.2.20
+- **Advisory**: https://osv.dev/vulnerability/PYSEC-2023-100
+
+### Tool Availability
+| Ecosystem | Tool | Status | Install Hint |
+|-----------|------|--------|--------------|
+| npm | npm audit | ✓ installed | — |
+| pip | pip-audit | ✗ missing | `pip install pip-audit` |
+| cargo | cargo-audit | ✗ missing | `cargo install cargo-audit` |
+```
+
+## Handling Missing Tools
+
+When an audit tool is not installed, the skill:
+1. Reports it as a warning (not a failure)
+2. Provides the install command for the missing tool
+3. Continues scanning other detected ecosystems
+
+Install hints per ecosystem:
+
+| Tool | Install Command |
+|------|----------------|
+| `pip-audit` | `pip install pip-audit` |
+| `cargo-audit` | `cargo install cargo-audit` |
+| `govulncheck` | `go install golang.org/x/vuln/cmd/govulncheck@latest` |
+| `bundle-audit` | `gem install bundler-audit` |
+| `composer` | Built-in since Composer 2.4 |
+
+## Rules
+
+- Never modify `package-lock.json`, `Cargo.lock`, or other lock files without `--fix` flag
+- Always report tool availability — missing tool is a finding, not a failure
+- Parse JSON output when available for structured data; fall back to text parsing
+- CRITICAL and HIGH findings should be highlighted prominently
+- Include advisory URLs for every CVE when available
+- This skill is READ-ONLY by default (no installs, no upgrades) unless `--fix` is passed
+- Respect `.auditrc`, `.nsprc`, or equivalent ignore files if present

package/app/skills/cve-scan/scripts/cve_scan.py

@@ -0,0 +1,412 @@
+#!/usr/bin/env python3
+"""CVE dependency scanner — detect ecosystems and run native audit tools.
+
+Stdlib only. No external dependencies.
+"""
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+ECOSYSTEMS = {
+    "npm": {
+        "manifests": ["package.json"],
+        "locks": ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"],
+        "tool": "npm",
+        "audit_cmd": ["npm", "audit", "--json"],
+        "fix_cmd": ["npm", "audit", "fix"],
+        "install_hint": "npm is bundled with Node.js",
+    },
+    "pip": {
+        "manifests": ["requirements.txt", "pyproject.toml", "setup.py", "setup.cfg"],
+        "locks": ["requirements.txt"],
+        "tool": "pip-audit",
+        "audit_cmd": ["pip-audit", "--format=json", "--output=-"],
+        "fix_cmd": ["pip-audit", "--fix"],
+        "install_hint": "pip install pip-audit",
+    },
+    "composer": {
+        "manifests": ["composer.json"],
+        "locks": ["composer.lock"],
+        "tool": "composer",
+        "audit_cmd": ["composer", "audit", "--format=json"],
+        "fix_cmd": ["composer", "update"],
+        "install_hint": "https://getcomposer.org/download/",
+    },
+    "cargo": {
+        "manifests": ["Cargo.toml"],
+        "locks": ["Cargo.lock"],
+        "tool": "cargo-audit",
+        "audit_cmd": ["cargo", "audit", "--json"],
+        "fix_cmd": ["cargo", "audit", "fix"],
+        "install_hint": "cargo install cargo-audit",
+    },
+    "go": {
+        "manifests": ["go.mod"],
+        "locks": ["go.sum"],
+        "tool": "govulncheck",
+        "audit_cmd": ["govulncheck", "-json", "./..."],
+        "fix_cmd": ["go", "get", "-u", "./..."],
+        "install_hint": "go install golang.org/x/vuln/cmd/govulncheck@latest",
+    },
+    "ruby": {
+        "manifests": ["Gemfile"],
+        "locks": ["Gemfile.lock"],
+        "tool": "bundle-audit",
+        "audit_cmd": ["bundle-audit", "check", "--format=json"],
+        "fix_cmd": ["bundle-audit", "update"],
+        "install_hint": "gem install bundler-audit",
+    },
+    "dart": {
+        "manifests": ["pubspec.yaml"],
+        "locks": ["pubspec.lock"],
+        "tool": "dart",
+        "audit_cmd": ["dart", "pub", "outdated", "--json"],
+        "fix_cmd": ["dart", "pub", "upgrade"],
+        "install_hint": "https://dart.dev/get-dart",
+    },
+}
+
+
+def detect_ecosystems(root: Path) -> list[dict]:
+    """Detect which package ecosystems are present in the project."""
+    found = []
+    for name, eco in ECOSYSTEMS.items():
+        detected_files = []
+        has_lock = False
+        for m in eco["manifests"]:
+            if (root / m).exists():
+                detected_files.append(m)
+        for m in eco["locks"]:
+            if (root / m).exists():
+                detected_files.append(m)
+                has_lock = True
+        # Deduplicate (requirements.txt is both manifest and lock)
+        detected_files = list(dict.fromkeys(detected_files))
+        if detected_files:
+            tool_path = shutil.which(eco["tool"])
+            found.append({
+                "name": name,
+                "files": detected_files,
+                "has_lock": has_lock,
+                "tool": eco["tool"],
+                "tool_available": tool_path is not None,
+                "install_hint": eco["install_hint"],
+                "audit_cmd": eco["audit_cmd"],
+                "fix_cmd": eco["fix_cmd"],
+            })
+    return found
+
+
+def run_audit(eco: dict, root: Path, fix: bool = False) -> dict:
+    """Run the native audit command for an ecosystem."""
+    cmd = eco["fix_cmd"] if fix else eco["audit_cmd"]
+    result = {
+        "ecosystem": eco["name"],
+        "tool": eco["tool"],
+        "command": " ".join(cmd),
+        "success": False,
+        "raw_output": "",
+        "error": "",
+    }
+
+    if not eco["tool_available"]:
+        result["error"] = f"Tool '{eco['tool']}' not installed. Install: {eco['install_hint']}"
+        return result
+
+    if not eco.get("has_lock", True) and eco["name"] in ("npm",):
+        result["warning"] = "No lock file — run `npm install` first"
+        result["success"] = True
+        return result
+
+    try:
+        proc = subprocess.run(
+            cmd,
+            cwd=str(root),
+            capture_output=True,
+            text=True,
+            timeout=120,
+        )
+        result["raw_output"] = proc.stdout
+        result["error"] = proc.stderr if proc.returncode not in (0, 1) else ""
+        # npm audit returns 1 when vulnerabilities found — that's not an error
+        result["success"] = True
+    except FileNotFoundError:
+        result["error"] = f"Tool '{eco['tool']}' not found in PATH"
+    except subprocess.TimeoutExpired:
+        result["error"] = f"Audit command timed out after 120s"
+
+    return result
+
+
+def parse_npm_audit(raw: str) -> list[dict]:
+    """Parse npm audit JSON output into unified findings."""
+    findings = []
+    try:
+        data = json.loads(raw)
+    except (json.JSONDecodeError, ValueError):
+        return findings
+
+    vulns = data.get("vulnerabilities", {})
+    for pkg_name, info in vulns.items():
+        for via in info.get("via", []):
+            if isinstance(via, dict):
+                severity = via.get("severity", "unknown").upper()
+                findings.append({
+                    "severity": severity,
+                    "package": pkg_name,
+                    "installed": info.get("range", "unknown"),
+                    "cve": via.get("cve", [via.get("url", "N/A")]),
+                    "title": via.get("title", "Unknown"),
+                    "url": via.get("url", ""),
+                    "fixed_in": info.get("fixAvailable", {}).get("version", "unknown") if isinstance(info.get("fixAvailable"), dict) else "unknown",
+                })
+    return findings
+
+
+def parse_pip_audit(raw: str) -> list[dict]:
+    """Parse pip-audit JSON output into unified findings."""
+    findings = []
+    try:
+        data = json.loads(raw)
+    except (json.JSONDecodeError, ValueError):
+        return findings
+
+    for dep in data.get("dependencies", []):
+        for vuln in dep.get("vulns", []):
+            vuln_id = vuln.get("id", "N/A")
+            aliases = vuln.get("aliases", [])
+            # Use GHSA link if available, otherwise OSV
+            url = ""
+            for alias in aliases:
+                if alias.startswith("GHSA-"):
+                    url = f"https://github.com/advisories/{alias}"
+                    break
+            if not url:
+                url = f"https://osv.dev/vulnerability/{vuln_id}"
+
+            fix_versions = vuln.get("fix_versions", [])
+            # Determine severity from CVE ID prefix heuristic — pip-audit
+            # doesn't provide severity directly, so we mark as HIGH by default
+            severity = "HIGH"
+
+            findings.append({
+                "severity": severity,
+                "package": f"{dep['name']}@{dep['version']}",
+                "installed": dep.get("version", "unknown"),
+                "cve": vuln_id,
+                "title": vuln.get("description", "")[:120] + ("..." if len(vuln.get("description", "")) > 120 else ""),
+                "url": url,
+                "fixed_in": ", ".join(fix_versions) if fix_versions else "unknown",
+            })
+    return findings
+
+
+def parse_cargo_audit(raw: str) -> list[dict]:
+    """Parse cargo audit JSON output into unified findings."""
+    findings = []
+    try:
+        data = json.loads(raw)
+    except (json.JSONDecodeError, ValueError):
+        return findings
+
+    for vuln in data.get("vulnerabilities", {}).get("list", []):
+        advisory = vuln.get("advisory", {})
+        pkg = vuln.get("package", {})
+        findings.append({
+            "severity": "HIGH",
+            "package": f"{pkg.get('name', 'unknown')}@{pkg.get('version', 'unknown')}",
+            "installed": pkg.get("version", "unknown"),
+            "cve": advisory.get("id", "N/A"),
+            "title": advisory.get("title", "Unknown"),
+            "url": advisory.get("url", ""),
+            "fixed_in": ", ".join(vuln.get("versions", {}).get("patched", [])) or "unknown",
+        })
+    return findings
+
+
+def _table(headers: list[str], rows: list[list[str]]) -> list[str]:
+    """Render an aligned plain-text table with box-drawing borders."""
+    widths = [len(h) for h in headers]
+    for row in rows:
+        for i, cell in enumerate(row):
+            widths[i] = max(widths[i], len(cell))
+
+    sep = "├" + "┼".join("─" * (w + 2) for w in widths) + "┤"
+    top = "┌" + "┬".join("─" * (w + 2) for w in widths) + "┐"
+    bot = "└" + "┴".join("─" * (w + 2) for w in widths) + "┘"
+
+    def fmt_row(cells: list[str]) -> str:
+        parts = []
+        for i, cell in enumerate(cells):
+            parts.append(f" {cell:<{widths[i]}} ")
+        return "│" + "│".join(parts) + "│"
+
+    lines = [top, fmt_row(headers), sep]
+    for row in rows:
+        lines.append(fmt_row(row))
+    lines.append(bot)
+    return lines
+
+
+def format_text_report(ecosystems: list[dict], results: list[dict], all_findings: list[dict]) -> str:
+    """Format findings as a terminal-friendly report."""
+    lines = ["", "═══ CVE Scan Report ═══", ""]
+
+    # Ecosystems detected
+    eco_rows = []
+    for eco in ecosystems:
+        status = "✓" if eco["tool_available"] else "⚠ not installed"
+        files = ", ".join(eco["files"])
+        eco_rows.append([eco["name"], files, eco["tool"], status])
+    lines.extend(_table(["Ecosystem", "Files", "Tool", "Status"], eco_rows))
+    lines.append("")
+
+    # Summary
+    severity_counts = {"CRITICAL": 0, "HIGH": 0, "MODERATE": 0, "MEDIUM": 0, "LOW": 0}
+    for f in all_findings:
+        sev = f["severity"].upper()
+        if sev in severity_counts:
+            severity_counts[sev] += 1
+        else:
+            severity_counts[sev] = severity_counts.get(sev, 0) + 1
+
+    # Merge MODERATE into MEDIUM for display
+    severity_counts["MEDIUM"] += severity_counts.pop("MODERATE", 0)
+
+    total = sum(severity_counts.values())
+    summary_rows = []
+    for sev in ["CRITICAL", "HIGH", "MEDIUM", "LOW"]:
+        if severity_counts.get(sev, 0) > 0:
+            summary_rows.append([sev, str(severity_counts[sev])])
+    summary_rows.append(["TOTAL", str(total)])
+    lines.extend(_table(["Severity", "Count"], summary_rows))
+    lines.append("")
+
+    if not all_findings:
+        lines.append("✓ No known vulnerabilities found.")
+        lines.append("")
+
+    # Findings by severity
+    if all_findings:
+        severity_order = {"CRITICAL": 0, "HIGH": 1, "MODERATE": 2, "MEDIUM": 2, "LOW": 3}
+        sorted_findings = sorted(all_findings, key=lambda f: severity_order.get(f["severity"].upper(), 9))
+
+        finding_rows = []
+        for f in sorted_findings:
+            sev = f["severity"].upper()
+            if sev == "MODERATE":
+                sev = "MEDIUM"
+            cve = f["cve"] if isinstance(f["cve"], str) else ", ".join(f["cve"]) if f["cve"] else "N/A"
+            title = f["title"][:60] + ("..." if len(f["title"]) > 60 else "")
+            finding_rows.append([sev, f["package"], cve, f["fixed_in"], title])
+
+        lines.extend(_table(["Severity", "Package", "CVE", "Fix", "Title"], finding_rows))
+        lines.append("")
+
+        # Detailed advisory links
+        lines.append("Advisory links:")
+        for f in sorted_findings:
+            if f.get("url"):
+                cve = f["cve"] if isinstance(f["cve"], str) else ", ".join(f["cve"]) if f["cve"] else "N/A"
+                lines.append(f"  {cve}: {f['url']}")
+        lines.append("")
+
+    # Install hints for missing tools
+    missing = [e for e in ecosystems if not e["tool_available"]]
+    if missing:
+        lines.append("Missing tools:")
+        for eco in missing:
+            lines.append(f"  {eco['name']}: install with: {eco['install_hint']}")
+        lines.append("")
+
+    # Warnings (non-fatal issues like missing lock files)
+    warnings = [r for r in results if r.get("warning")]
+    if warnings:
+        for r in warnings:
+            lines.append(f"⚠ {r['ecosystem']}: {r['warning']}")
+        lines.append("")
+
+    # Errors (fatal issues)
+    errors = [r for r in results if r.get("error")]
+    if errors:
+        for r in errors:
+            lines.append(f"✗ {r['ecosystem']}: {r['error']}")
+        lines.append("")
+
+    return "\n".join(lines)
+
+
+def main():
+    import argparse
+
+    parser = argparse.ArgumentParser(description="CVE dependency scanner")
+    parser.add_argument("--json", action="store_true", help="JSON output")
+    parser.add_argument("--fix", action="store_true", help="Auto-fix vulnerabilities")
+    parser.add_argument("--ecosystem", type=str, help="Scan specific ecosystem only")
+    parser.add_argument("path", nargs="?", default=".", help="Project root path")
+    args = parser.parse_args()
+
+    root = Path(args.path).resolve()
+    if not root.is_dir():
+        print(f"Error: {root} is not a directory", file=sys.stderr)
+        sys.exit(1)
+
+    # Detect
+    ecosystems = detect_ecosystems(root)
+    if args.ecosystem:
+        ecosystems = [e for e in ecosystems if e["name"] == args.ecosystem]
+
+    if not ecosystems:
+        msg = "No supported package ecosystems detected."
+        if args.json:
+            print(json.dumps({"ecosystems": [], "findings": [], "message": msg}))
+        else:
+            print(msg)
+        sys.exit(0)
+
+    # Run audits
+    results = []
+    all_findings = []
+    for eco in ecosystems:
+        result = run_audit(eco, root, fix=args.fix)
+        results.append(result)
+
+        # Parse results with ecosystem-specific parsers
+        if result["success"] and result["raw_output"]:
+            parsers = {
+                "npm": parse_npm_audit,
+                "pip": parse_pip_audit,
+                "cargo": parse_cargo_audit,
+            }
+            parser = parsers.get(eco["name"])
+            if parser:
+                findings = parser(result["raw_output"])
+                for f in findings:
+                    f["ecosystem"] = eco["name"]
+                all_findings.extend(findings)
+
+    # Output
+    if args.json:
+        output = {
+            "ecosystems": [{"name": e["name"], "files": e["files"], "tool_available": e["tool_available"]} for e in ecosystems],
+            "results": results,
+            "findings": all_findings,
+            "total_findings": len(all_findings),
+        }
+        print(json.dumps(output, indent=2))
+    else:
+        report = format_text_report(ecosystems, results, all_findings)
+        print(report)
+
+    # Exit code: non-zero if CRITICAL or HIGH found
+    high_or_critical = [f for f in all_findings if f["severity"].upper() in ("CRITICAL", "HIGH")]
+    if high_or_critical:
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

package/app/skills/workflow/SKILL.md

@@ -188,13 +188,13 @@ Agent(subagent_type="code-reviewer",         prompt="Review test quality — no
 # Sequential recon:
 Agent(subagent_type="explorer-agent",        prompt="Map attack surface, entry points, data flows. READ-ONLY.")
 # Parallel audit:
-Agent(subagent_type="security-auditor",      prompt="OWASP Top 10, injection, auth review. READ-ONLY.")
+Agent(subagent_type="security-auditor",      prompt="Run /cve-scan first, then OWASP Top 10, injection, auth review. READ-ONLY.")
 Agent(subagent_type="code-reviewer",         prompt="Secrets in code, error handling, logging gaps. READ-ONLY.")
 Agent(subagent_type="devops-implementer",    prompt="Infra misconfig, Docker hardening, network. READ-ONLY.")
 Agent(subagent_type="database-architect",    prompt="SQL injection vectors, access controls, encryption. READ-ONLY.")
 # Sequential:
-Agent(subagent_type="tech-lead",             prompt="Prioritize findings, assign severity (CVSS).")
-Agent(subagent_type="documenter",            prompt="Security audit report + remediation checklist. Own files: kb/")
+Agent(subagent_type="tech-lead",             prompt="Prioritize findings including CVE scan results, assign severity (CVSS).")
+Agent(subagent_type="documenter",            prompt="Security audit report + CVE inventory + remediation checklist. Own files: kb/")
 ```
 
 **`codebase-onboarding`** — understand an unfamiliar codebase fast (READ-ONLY)

package/kb/reference/architecture-overview.md

@@ -3,9 +3,9 @@ title: "AI Toolkit - Architecture Overview"
 category: reference
 service: ai-toolkit
 tags: [architecture, overview, design, structure]
-version: "1.3.10"
+version: "1.3.14"
 created: "2026-03-23"
-last_updated: "2026-04-07"
+last_updated: "2026-04-08"
 description: "Architecture of ai-toolkit: directory layout, global install model, skill tiers, and integration with projects."
 ---
 
@@ -166,7 +166,7 @@ Three tiers determine how to approach a task:
 | Type | Field | Invocation | Count |
 |------|-------|-----------|-------|
 | Task | `disable-model-invocation: true` | User via `/skill` only | 28 |
-| Hybrid | (neither) | User via `/skill` + agent knowledge | 30 |
+| Hybrid | (neither) | User via `/skill` + agent knowledge | 31 |
 | Knowledge | `user-invocable: false` | Claude auto-loads | 32 |
 
 ## Multi-Agent Execution

package/kb/reference/skills-catalog.md

@@ -3,9 +3,9 @@ title: "AI Toolkit - Skills Catalog"
 category: reference
 service: ai-toolkit
 tags: [skills, domain-knowledge, catalog, task-skills, hybrid-skills]
-version: "1.3.10"
+version: "1.3.14"
 created: "2026-03-23"
-last_updated: "2026-04-07"
+last_updated: "2026-04-08"
 description: "Complete skills catalog with task, hybrid, and knowledge skills. Includes effort levels, skill-scoped hooks, executable scripts, security auditor, and persona presets."
 ---
 
@@ -56,7 +56,7 @@ Task skills execute a specific action. Invoked via slash commands. `disable-mode
 | **prd-to-issues** | `/prd-to-issues` | medium | Break PRD into GitHub issues with vertical slices and HITL/AFK tagging |
 | **skill-audit** | `/skill-audit` | medium | Scan skills and agents for security risks: dangerous patterns, secrets, excessive permissions |
 
-## Hybrid Skills (30)
+## Hybrid Skills (31)
 
 Hybrid skills combine slash-command invocation with domain knowledge that agents reference.
 
@@ -68,6 +68,7 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 | **plan** | `/plan` | high | Create structured plan with task breakdown and agent assignments |
 | **refactor** | `/refactor` | high | Plan and execute code refactoring with safety checks (Tier 1 — single agent) |
 | **analyze** | `/analyze` | medium | Analyze code quality, complexity, and patterns |
+| **cve-scan** | `/cve-scan` | medium | Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, ruby, dart) |
 | **docs** | `/docs` | high | Generate/update docs: README, API docs, architecture notes, changelogs (Tier 1 — single agent) |
 | **search** | `/search` | medium | Search knowledge base (MCP tools with local fallback) |
 | **explain** | `/explain` | medium | Explain architecture of a file/module using Mermaid diagrams |

package/llms-full.txt

@@ -63,6 +63,7 @@
 - **commit**: Create Conventional Commits with pre-commit validation
 - **council**: 4-perspective decision evaluation for architecture choices. Use when user wants multi-angle analysis, needs to decide between alternatives, or mentions 'council', 'evaluate decision', 'pros cons'.
 - **csharp-patterns**: Loaded when user asks about C# or .NET development patterns
+- **cve-scan**: Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, bundler, dart)
 - **database-patterns**: Loaded when user asks about database schema or query optimization
 - **debug**: Debug errors and trace root causes systematically
 - **debugging-tactics**: Loaded when user is debugging an issue or needs root cause analysis
@@ -933,9 +934,9 @@ title: "AI Toolkit - Architecture Overview"
 category: reference
 service: ai-toolkit
 tags: [architecture, overview, design, structure]
-version: "1.3.10"
+version: "1.3.14"
 created: "2026-03-23"
-last_updated: "2026-04-07"
+last_updated: "2026-04-08"
 description: "Architecture of ai-toolkit: directory layout, global install model, skill tiers, and integration with projects."
 ---
 
@@ -1096,7 +1097,7 @@ Three tiers determine how to approach a task:
 | Type | Field | Invocation | Count |
 |------|-------|-----------|-------|
 | Task | `disable-model-invocation: true` | User via `/skill` only | 28 |
-| Hybrid | (neither) | User via `/skill` + agent knowledge | 30 |
+| Hybrid | (neither) | User via `/skill` + agent knowledge | 31 |
 | Knowledge | `user-invocable: false` | Claude auto-loads | 32 |
 
 ## Multi-Agent Execution
@@ -4094,9 +4095,9 @@ title: "AI Toolkit - Skills Catalog"
 category: reference
 service: ai-toolkit
 tags: [skills, domain-knowledge, catalog, task-skills, hybrid-skills]
-version: "1.3.10"
+version: "1.3.14"
 created: "2026-03-23"
-last_updated: "2026-04-07"
+last_updated: "2026-04-08"
 description: "Complete skills catalog with task, hybrid, and knowledge skills. Includes effort levels, skill-scoped hooks, executable scripts, security auditor, and persona presets."
 ---
 
@@ -4147,7 +4148,7 @@ Task skills execute a specific action. Invoked via slash commands. `disable-mode
 | **prd-to-issues** | `/prd-to-issues` | medium | Break PRD into GitHub issues with vertical slices and HITL/AFK tagging |
 | **skill-audit** | `/skill-audit` | medium | Scan skills and agents for security risks: dangerous patterns, secrets, excessive permissions |
 
-## Hybrid Skills (30)
+## Hybrid Skills (31)
 
 Hybrid skills combine slash-command invocation with domain knowledge that agents reference.
 
@@ -4159,6 +4160,7 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 | **plan** | `/plan` | high | Create structured plan with task breakdown and agent assignments |
 | **refactor** | `/refactor` | high | Plan and execute code refactoring with safety checks (Tier 1 — single agent) |
 | **analyze** | `/analyze` | medium | Analyze code quality, complexity, and patterns |
+| **cve-scan** | `/cve-scan` | medium | Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, ruby, dart) |
 | **docs** | `/docs` | high | Generate/update docs: README, API docs, architecture notes, changelogs (Tier 1 — single agent) |
 | **search** | `/search` | medium | Search knowledge base (MCP tools with local fallback) |
 | **explain** | `/explain` | medium | Explain architecture of a file/module using Mermaid diagrams |

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.3.12",
+  "version": "1.3.14",
   "components": {
     "agents": {
       "description": "44 specialized agents (orchestrator, backend, frontend, security, devops, etc.)",
@@ -9,7 +9,7 @@
       "tags": ["core", "agents"]
     },
     "skills": {
-      "description": "90 skills (28 task + 30 hybrid + 32 knowledge)",
+      "description": "91 skills (28 task + 31 hybrid + 32 knowledge)",
       "path": "app/skills",
       "target": ".claude/skills",
       "type": "symlink",
@@ -90,7 +90,7 @@
       "default": true
     },
     "skills": {
-      "description": "90 skills (task, hybrid, knowledge)",
+      "description": "91 skills (task, hybrid, knowledge)",
       "default": true
     },
     "rules-common": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "1.3.13",
-  "description": "Professional-grade AI coding toolkit: 90 skills, 44 agents, multi-platform support (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment), machine-enforced safety constitution, persona presets, skill security auditor, expanded lifecycle hooks, 11 plugin packs, and benchmark tooling.",
+  "version": "1.3.14",
+  "description": "Professional-grade AI coding toolkit: 91 skills, 44 agents, multi-platform support (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment), machine-enforced safety constitution, persona presets, skill security auditor, expanded lifecycle hooks, 11 plugin packs, and benchmark tooling.",
   "keywords": [
     "claude",
     "claude-code",

package/scripts/check_deps.py

@@ -96,6 +96,58 @@ OPTIONAL = [
         },
         "reason": "Running toolkit test suite (npm test)",
     },
+    {
+        "name": "pip-audit",
+        "check": "pip-audit",
+        "packages": {
+            "brew": "pip-audit  # or: pip install pip-audit",
+            "apt": "pip-audit  # pip install pip-audit",
+            "dnf": "pip-audit  # pip install pip-audit",
+            "pacman": "pip-audit  # pip install pip-audit",
+            "apk": "pip-audit  # pip install pip-audit",
+            "zypper": "pip-audit  # pip install pip-audit",
+        },
+        "reason": "CVE scanner (/cve-scan) for Python dependencies",
+    },
+    {
+        "name": "cargo-audit",
+        "check": "cargo-audit",
+        "packages": {
+            "brew": "cargo-audit  # or: cargo install cargo-audit",
+            "apt": "cargo-audit  # cargo install cargo-audit",
+            "dnf": "cargo-audit  # cargo install cargo-audit",
+            "pacman": "cargo-audit  # cargo install cargo-audit",
+            "apk": "cargo-audit  # cargo install cargo-audit",
+            "zypper": "cargo-audit  # cargo install cargo-audit",
+        },
+        "reason": "CVE scanner (/cve-scan) for Rust dependencies",
+    },
+    {
+        "name": "govulncheck",
+        "check": "govulncheck",
+        "packages": {
+            "brew": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "apt": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "dnf": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "pacman": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "apk": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "zypper": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+        },
+        "reason": "CVE scanner (/cve-scan) for Go dependencies",
+    },
+    {
+        "name": "bundle-audit",
+        "check": "bundle-audit",
+        "packages": {
+            "brew": "bundler-audit  # or: gem install bundler-audit",
+            "apt": "bundler-audit  # gem install bundler-audit",
+            "dnf": "bundler-audit  # gem install bundler-audit",
+            "pacman": "bundler-audit  # gem install bundler-audit",
+            "apk": "bundler-audit  # gem install bundler-audit",
+            "zypper": "bundler-audit  # gem install bundler-audit",
+        },
+        "reason": "CVE scanner (/cve-scan) for Ruby dependencies",
+    },
 ]