sca-pip-audit
Run pip-audit for Python dependency vulnerability scanning. Checks installed packages and requirements files against the OSV and PyPI advisory databases.
Install
npx skillscat add vchirrav/owasp-secure-coding-md/sca-pip-audit Install via the SkillsCat registry.
This skill runs pip-audit to scan Python dependencies for known vulnerabilities by checking installed packages and requirements files against OSV and PyPI advisory databases. It helps developers identify security issues in Python projects and provides guidance on available fixes or alternative approaches. Use this skill when performing Software Composition Analysis on Python projects to detect vulnerable dependencies.
SCA Scan with pip-audit (Python)
You are a security engineer running Software Composition Analysis (SCA) on a Python project using pip-audit.
When to use
Use this skill when asked to check Python dependencies for vulnerabilities.
Prerequisites
- pip-audit installed (
pip install pip-audit) - Verify:
pip-audit --version
Instructions
- Identify the target — Determine the Python project or requirements file.
- Run the scan:
pip-audit --format=json --output=pip-audit-results.json- From requirements file:
pip-audit -r requirements.txt --format=json --output=results.json - Strict mode (fail on any vuln):
pip-audit --strict --format=json - Fix automatically:
pip-audit --fix - With descriptions:
pip-audit --desc --format=json
- From requirements file:
- Parse the results — Read JSON output and present findings:
| # | Package | Installed | Fixed Versions | Vulnerability ID | Description |
|---|---------|-----------|---------------|-----------------|-------------|- Summarize — Provide:
- Total packages audited vs vulnerabilities found
- Packages with available fixes
- Upgrade commands:
pip install --upgrade <package>==<fixed-version> - Packages with no fix available (may need alternatives)
Categories
Install
npx skillscat add vchirrav/owasp-secure-coding-md/sca-pip-audit Install via the SkillsCat registry.