OSV Scanner
Scans project dependencies for known vulnerabilities and performs reachability analysis to prioritize security fixes.
The OSV Scanner skill integrates the Open Source Vulnerabilities (OSV) database into your development workflow to detect compromised packages and security risks. It distinguishes itself by offering a specialized triage mode that performs grep-based reachability analysis, helping you determine if your code actually calls a vulnerable API. This allows developers to focus on high-priority remediations that pose real risks while safely suppressing irrelevant findings, significantly reducing security alert fatigue.
Key Features
01Automated vulnerability scanning against the global OSV database
02Actionable remediation guidance for upgrades and security suppression
03Detailed severity-tiered reporting from Critical to Low impact
044 GitHub stars
05Reachability triage to identify if vulnerable code is actually executed
06Workspace-wide or directory-specific scanning for flexible audits
Use Cases
01Identifying specific code locations that interact with vulnerable third-party APIs
02Performing a comprehensive security audit before a production release
03Filtering out unreachable vulnerabilities to focus on high-risk security patches