Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Rebrand to Anvil AI. Remove CacheForge marketing copy. Normalize install commands.
What This Skill Does
Scans a project's dependency tree for known CVEs across npm, pip, Cargo, and Go ecosystems. Runs each ecosystem's native audit tooling against existing lockfiles and produces a unified severity report. No API keys, accounts, or configuration required.
Covers four ecosystems in a single workflow without requiring any accounts, API keys, or per-project configuration.
When to use it
- Checking a Node.js app for CVEs before a production deploy
- Auditing Python packages after a public security advisory
- Scanning a Rust crate's dependencies during code review
- Generating an SBOM for a compliance or procurement requirement
- Reviewing all projects in a directory for unpatched vulnerabilities
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Audit this project for vulnerabilities
- 1Run detect script on the target directory to identify lockfiles and available audit tools
- 2Execute the appropriate audit script for each detected ecosystem
- 3Aggregate per-ecosystem JSON results into a unified report
- 4Present findings by severity with Critical and High issues listed first
- 5Offer fix commands only if the user asks, and require explicit confirmation before running any
Markdown report showing total vulnerability count by severity, with Critical/High findings highlighted and any skipped ecosystems noted