What it does. 'This skill covers implementing Software Composition Analysis (SCA) using Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-sca-dependency-scanning-with-snyk/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-sca-dependency-scanning-with-snyk, or copy the skill folder into ~/.claude/skills/performing-sca-dependency-scanning-with-snyk/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sca-dependency-scanning-with-snyk/SKILL.md

SKILL.md (verbatim)

name: performing-sca-dependency-scanning-with-snyk
description: 'This skill covers implementing Software Composition Analysis (SCA) using
  Snyk to detect vulnerable open-source dependencies in CI/CD pipelines. It addresses
  scanning package manifests and lockfiles, automated fix pull request generation,
  license compliance checking, continuous monitoring of deployed applications, and
  integration with GitHub, GitLab, and Jenkins pipelines.

  '
domain: cybersecurity
subdomain: devsecops
tags:
- devsecops
- cicd
- sca
- snyk
- dependency-scanning
- secure-sdlc
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- GV.SC-07
- ID.IM-04
- PR.PS-04
mitre_attack:
- T1195
- T1554
- T1059.004

Performing SCA Dependency Scanning with Snyk

When to Use

• When applications use open-source packages that may contain known vulnerabilities
• When compliance requires tracking and remediating vulnerable dependencies (PCI DSS, SOC 2)
• When needing automated fix PRs for vulnerable dependencies in CI/CD
• When license compliance requires visibility into open-source license obligations
• When continuous monitoring is needed for newly disclosed vulnerabilities in deployed dependencies

Do not use for scanning proprietary application code for logic vulnerabilities (use SAST), for runtime vulnerability detection (use DAST), or for container OS package scanning alone (use Trivy for a free alternative).

Prerequisites

• Snyk account (free tier covers up to 200 tests per month for open source)
• Snyk CLI installed or Snyk GitHub/GitLab integration configured
• SNYK_TOKEN environment variable set with API authentication token
• Project with supported package manifests: package.json, requirements.txt, pom.xml, go.mod, Gemfile, etc.

Workflow

Step 1: Install and Authenticate Snyk CLI

# Install Snyk CLI
npm install -g snyk

# Authenticate with Snyk
snyk auth $SNYK_TOKEN

# Test the connection
snyk test --json | jq '.summary'

Step 2: Scan Dependencies in CI/CD Pipeline

# .github/workflows/dependency-scan.yml
name: Dependency Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 8 * * 1'  # Weekly Monday 8am

jobs:
  snyk-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: >
            --severity-threshold=high
            --fail-on=upgradable
            --json-file-output=snyk-results.json

      - name: Upload results to Snyk
        if: always()
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: monitor
          args: --project-name=${{ github.repository }}

      - name: Upload SARIF
        if: always()
        run: |
          npx snyk-to-html -i snyk-results.json -o snyk-report.html

Step 3: Configure Snyk for Multiple Languages

# Python project scanning
snyk test --file=requirements.txt --severity-threshold=high --json > snyk-python.json

# Java/Maven project
snyk test --file=pom.xml --severity-threshold=medium --json > snyk-java.json

# Go module scanning
snyk test --file=go.mod --severity-threshold=high --json > snyk-go.json

# Docker image dependency scanning
snyk container test myapp:latest --severity-threshold=high --json > snyk-container.json

# Monorepo: scan all projects
snyk test --all-projects --severity-threshold=high --json > snyk-all.json

# IaC scanning (bonus)
snyk iac test terraform/ --severity-threshold=medium --json > snyk-iac.json

Step 4: Configure Snyk Policies for Organization

# .snyk policy file
version: v1.25.0
ignore:
  SNYK-JS-LODASH-1018905:
    - '*':
        reason: "Prototype pollution in lodash. Not exploitable in our usage - no user input reaches affected function."
        expires: 2026-06-01T00:00:00.000Z
        created: 2026-02-23T00:00:00.000Z

  SNYK-PYTHON-REQUESTS-6241864:
    - '*':
        reason: "SSRF in requests redirect handling. Mitigated by allowlist at proxy layer."
        expires: 2026-04-01T00:00:00.000Z

patch: {}

# Severity threshold for CI failures
failOnSeverity: high

Step 5: Enable Automated Fix Pull Requests

# Snyk fix: generate fix PRs for vulnerable dependencies
snyk fix --dry-run  # Preview changes

# Apply fixes locally
snyk fix

# Enable auto-fix PRs via Snyk dashboard:
# 1. Navigate to Organization Settings > Integrations > GitHub
# 2. Enable "Automatic fix pull requests"
# 3. Set "Fix only direct dependencies" or "Fix direct and transitive"
# 4. Configure branch target (main or develop)

Step 6: License Compliance Scanning

# Check license compliance
snyk test --json | jq '.licensesPolicy'

# Snyk license policy configuration via organization settings:
# - Approved licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC
# - Restricted licenses: GPL-3.0, AGPL-3.0 (copyleft risk)
# - Unknown licenses: Flag for manual review

Key Concepts

Term	Definition
SCA	Software Composition Analysis — identifies vulnerabilities and license risks in open-source dependencies
Transitive Dependency	A dependency of a direct dependency, often invisible to developers but still a vulnerability vector
Fix PR	Automated pull request generated by Snyk that upgrades a vulnerable dependency to a patched version
Snyk Monitor	Continuous monitoring mode that watches deployed projects for newly disclosed vulnerabilities
Exploit Maturity	Snyk's assessment of whether a vulnerability has known exploits, proof-of-concept, or no known exploit
Reachable Vulnerability	A vulnerability in a function that is actually called by the application code, not just present in the dependency
License Policy	Organization-level rules defining which open-source licenses are approved, restricted, or require review

Tools & Systems

• Snyk Open Source: SCA tool for scanning dependencies across 10+ language ecosystems
• Snyk CLI: Command-line interface for local and CI/CD scanning of dependencies
• Snyk Advisor: Package health scoring tool evaluating maintenance, popularity, and security signals
• OWASP Dependency-Check: Free alternative SCA tool using NVD data for vulnerability matching
• npm audit / pip-audit: Language-specific built-in audit tools for basic vulnerability checking

Common Scenarios

Scenario: Triaging a Critical Transitive Dependency Vulnerability

Context: Snyk reports a critical RCE vulnerability in a transitive dependency (log4j in a Java application). The direct dependency has not released a patch.

Approach:

1. Use snyk test --json and examine the dependency path to identify which direct dependency pulls in the vulnerable transitive
2. Check exploit maturity: if "Mature" or "Proof of Concept", prioritize immediately
3. If no direct fix exists, use Snyk's patch mechanism or override the transitive version in the build config
4. For Maven: add <dependencyManagement> section to force the safe version of the transitive dependency
5. For npm: add an overrides section in package.json to pin the safe version
6. Add a Snyk ignore with expiration date if no patch is available yet
7. Monitor the direct dependency for a release that updates the transitive

Pitfalls: Ignoring transitive vulnerabilities because "we don't use that function directly" is risky. Attackers can chain vulnerabilities across dependency boundaries. Version overrides can break API compatibility between the direct and transitive dependency.

Output Format

Snyk Dependency Scan Report
=============================
Project: org/web-application
Manifest: package.json
Dependencies: 342 (47 direct, 295 transitive)
Scan Date: 2026-02-23

VULNERABILITY SUMMARY:
  Critical: 1  (1 fixable)
  High: 4      (3 fixable)
  Medium: 12   (8 fixable)
  Low: 23      (15 fixable)

CRITICAL:
  SNYK-JS-EXPRESS-1234567
    Package: express@4.17.1 (direct)
    Severity: Critical (CVSS 9.8)
    Exploit: Mature
    Fix: Upgrade to express@4.21.0
    Path: express@4.17.1

HIGH:
  SNYK-JS-JSONWEBTOKEN-5678901
    Package: jsonwebtoken@8.5.1 (transitive)
    Severity: High (CVSS 7.6)
    Exploit: Proof of Concept
    Fix: Upgrade passport@0.7.0 (which upgrades jsonwebtoken)
    Path: passport@0.6.0 > jsonwebtoken@8.5.1

LICENSE ISSUES:
  [RESTRICTED] GPL-3.0: some-package@1.2.3 (transitive via other-pkg)

QUALITY GATE: FAILED (1 Critical with fix available)

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Snyk SCA Scanning Templates

GitHub Actions: Multi-Language SCA Pipeline

# .github/workflows/sca-scanning.yml
name: SCA Dependency Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    paths:
      - 'package*.json'
      - 'requirements*.txt'
      - 'Pipfile*'
      - 'pom.xml'
      - 'build.gradle*'
      - 'go.mod'
      - 'Gemfile*'

jobs:
  snyk-node:
    name: Snyk Node.js
    runs-on: ubuntu-latest
    if: hashFiles('package.json') != ''
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npm ci
      - uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high --fail-on=upgradable

  snyk-python:
    name: Snyk Python
    runs-on: ubuntu-latest
    if: hashFiles('requirements.txt') != ''
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '3.12' }
      - run: pip install -r requirements.txt
      - uses: snyk/actions/python-3.10@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

  monitor:
    name: Snyk Monitor
    needs: [snyk-node, snyk-python]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: monitor
          args: --all-projects

Snyk Policy File

# .snyk
version: v1.25.0
ignore:
  # Accepted risk with documented justification and expiry
  SNYK-JS-LODASH-1018905:
    - '*':
        reason: "Not exploitable: user input never reaches _.template()"
        expires: 2026-06-01T00:00:00.000Z
        created: 2026-02-23T00:00:00.000Z

patch: {}

Snyk Configuration for License Compliance

{
  "org_settings": {
    "license_policy": {
      "approved": ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unlicense", "0BSD"],
      "review_required": ["LGPL-2.1", "LGPL-3.0", "MPL-2.0", "CDDL-1.0"],
      "restricted": ["GPL-2.0", "GPL-3.0", "AGPL-3.0", "SSPL-1.0"],
      "severity_for_unknown": "high"
    }
  }
}

OWASP Dependency-Check Alternative (Free)

# .github/workflows/dependency-check.yml
name: OWASP Dependency Check

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 8 * * 1'

jobs:
  dependency-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run OWASP Dependency-Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: 'my-app'
          path: '.'
          format: 'HTML'
          args: >
            --failOnCVSS 7
            --enableRetired
      - name: Upload report
        uses: actions/upload-artifact@v4
        with:
          name: dependency-check-report
          path: reports/

references/api-reference.md (verbatim)

SCA Dependency Scanning with Snyk - API Reference

Snyk CLI Commands

snyk test

Scans project dependencies for known vulnerabilities.

snyk test --json --severity-threshold=high
snyk test --json --all-projects          # Monorepo support
snyk test --json --file=package-lock.json

Exit codes:

• 0: No vulnerabilities found
• 1: Vulnerabilities found
• 2: Failure (missing manifest, auth error)

snyk monitor

Creates a project snapshot for continuous monitoring on snyk.io.

snyk monitor --json --project-name="my-app"

snyk auth

Authenticate with Snyk API token.

snyk auth <API_TOKEN>
export SNYK_TOKEN=<API_TOKEN>

JSON Output Structure

Test Result Fields

Field	Type	Description
vulnerabilities	array	List of vulnerability objects
ok	boolean	True if no vulns found
dependencyCount	int	Total dependencies scanned
packageManager	string	npm, pip, maven, etc.
uniqueCount	int	Unique vulnerability count

Vulnerability Object

Field	Type	Description
id	string	Snyk vulnerability ID (e.g., SNYK-JS-LODASH-590103)
title	string	Human-readable title
severity	string	critical, high, medium, low
cvssScore	float	CVSS v3.1 score (0-10)
packageName	string	Affected package name
version	string	Installed version
fixedIn	array	Versions with fix available
exploit	string	Exploit maturity: Mature, Proof of Concept, Not Defined
isUpgradable	boolean	Can be fixed by upgrading direct dependency
isPatchable	boolean	Snyk patch available
from	array	Dependency path from root

SARIF Integration

Snyk results can be converted to SARIF 2.1.0 for GitHub Code Scanning. The SARIF schema is at: https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json

Severity Mapping

Snyk Severity	CVSS Range	SARIF Level
critical	9.0 - 10.0	error
high	7.0 - 8.9	error
medium	4.0 - 6.9	warning
low	0.1 - 3.9	warning

CLI Usage

python agent.py --project /app --severity high --max-critical 0 --max-high 5 --output report.json

references/standards.md (verbatim)

Standards Reference: SCA Dependency Scanning with Snyk

OWASP Top 10 - A06:2021 Vulnerable and Outdated Components

• Applications using components with known vulnerabilities may be exploitable
• SCA tools like Snyk identify vulnerable versions and provide upgrade paths
• Includes both direct and transitive dependency scanning

NIST SSDF (SP 800-218)

PW.4: Reuse Existing, Well-Secured Software

• PW.4.1: Verify that acquired software meets security requirements
• PW.4.2: Review, analyze, and test software to identify vulnerabilities
• SCA scanning of all third-party components before integration

PW.4.4: Maintain Provenance Data

• Track the origin and version of all third-party software components
• Snyk monitor provides continuous tracking of dependency versions

CIS Software Supply Chain Security

Dependencies (DP) Controls

• DP-1: Pin dependencies to specific versions
• DP-2: Automate dependency vulnerability scanning in CI/CD
• DP-3: Review and approve new dependency additions
• DP-4: Monitor deployed dependencies for newly disclosed vulnerabilities

OWASP SAMM - Software Security

Security Testing - Maturity Level 1

• Automated dependency scanning using default configurations
• Visibility of vulnerable components to development teams

Security Testing - Maturity Level 2

• Custom policies for severity thresholds and license compliance
• Automated fix PRs for upgradable vulnerabilities
• Tracking of exploit maturity to prioritize remediation

Security Testing - Maturity Level 3

• Reachability analysis to identify actually exploitable vulnerabilities
• Integration with vulnerability management for SLA tracking
• Correlation with runtime monitoring for risk-based prioritization

PCI DSS v4.0

• 6.2.4: Use automated methods to prevent common software attacks
• 6.3.2: Maintain an inventory of custom and third-party software components
• 6.3.3: Software components not needed for operation removed or identified

Executive Order 14028 (US Federal)

• Section 4(e): Agencies shall employ automated tools for continuous monitoring of vulnerabilities in software
• SBOM requirement: All software suppliers must provide SBOMs listing all components including open-source
• Aligns with Snyk's SBOM generation and continuous monitoring capabilities

License Compliance Framework

License Type	Risk Level	Policy	Examples
Permissive	Low	Auto-approve	MIT, BSD-2, BSD-3, ISC, Apache-2.0
Weak Copyleft	Medium	Review	LGPL-2.1, LGPL-3.0, MPL-2.0
Strong Copyleft	High	Restrict	GPL-2.0, GPL-3.0, AGPL-3.0
Unknown/Custom	High	Manual Review	Proprietary, SSPL, BSL

references/workflows.md (verbatim)

Workflow Reference: SCA Dependency Scanning with Snyk

Dependency Scanning Pipeline

Code Push / PR
       │
       ▼
┌──────────────────┐
│ Install Deps     │
│ (npm ci, pip     │
│  install, etc.)  │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐
│ Snyk Test        │──── Report JSON ───> Artifact Storage
│ (vuln scan)      │
└──────┬───────────┘
       │
  ┌────┴────┐
  │         │
PASS      FAIL ──────> PR Comment with vuln details
  │                     │
  │                     ▼
  │              ┌──────────────┐
  │              │ Snyk Fix PR  │
  │              │ (auto-gen)   │
  │              └──────────────┘
  ▼
┌──────────────────┐
│ Snyk Monitor     │
│ (continuous)     │
└──────┬───────────┘
       │
       ▼
  Ongoing alerts for
  new disclosures

Snyk CLI Command Reference

Scanning Commands

# Basic vulnerability test
snyk test

# Test with severity filter
snyk test --severity-threshold=high

# Test with exploit maturity filter
snyk test --severity-threshold=high

# Test specific manifest
snyk test --file=package-lock.json

# Test all projects in monorepo
snyk test --all-projects

# Test with dev dependencies excluded
snyk test --production

# Output in JSON
snyk test --json --json-file-output=results.json

# Output in SARIF
snyk test --sarif --sarif-file-output=results.sarif

Monitoring Commands

# Monitor project for new vulnerabilities
snyk monitor --project-name="my-app-prod"

# Monitor specific branch
snyk monitor --target-reference=main

# Monitor with tags
snyk monitor --project-tags=env=production,team=platform

Fix Commands

# Preview available fixes
snyk fix --dry-run

# Apply fixes to direct dependencies
snyk fix

# Apply fixes including dev dependencies
snyk fix --dev

Vulnerability Prioritization Matrix

Factor	Score Weight	Description
CVSS Score	30%	Base vulnerability severity
Exploit Maturity	25%	Mature > POC > No Known Exploit
Reachability	20%	Function called > Imported > Present
Fix Availability	15%	Upgrade available > Patch > None
Dependency Depth	10%	Direct > Transitive (1 hop) > Deep transitive

Snyk Integration Options

Platform	Integration Method	Features
GitHub	GitHub App	Auto-scan PRs, fix PRs, SARIF upload
GitLab	GitLab Integration	MR comments, dependency scanning
Jenkins	Snyk Plugin	Pipeline step, HTML reports
Azure DevOps	Extension	Pipeline task, dashboard widget
Bitbucket	Bitbucket App	PR checks, fix PRs
CLI	npm/binary	Local scanning, CI/CD integration

Remediation Strategy by Vulnerability Type

Direct Dependency Vulnerability

1. Check if upgrade is available: snyk test --json | jq '.vulnerabilities[] | select(.isUpgradable)'
2. If upgradable: run snyk fix or manually upgrade
3. Verify no breaking changes in the upgrade
4. If not upgradable: check for patch or accept risk with ignore

Transitive Dependency Vulnerability

1. Identify the dependency chain: snyk test --json | jq '.vulnerabilities[].from'
2. Check if upgrading the direct dependency resolves it
3. If not: use version overrides in package manager
4. npm: overrides in package.json
5. Maven: dependencyManagement in pom.xml
6. Gradle: constraints in build.gradle
7. Poetry: tool.poetry.extras or constraint resolution

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.