---
name: dependency-vulnerability-scanning-in-ci
description: CI/CD supply chain security scanner for auditing Python dependencies
  against CVE/OSV advisory databases, blocking builds with CRITICAL/HIGH vulnerabilities,
  and generating SBOM reports.
domain: Infrastructure & DevOps
subdomain: Supply Chain Security & CI/CD
tags:
- vulnerability-scanning
- ci-cd-security
- pip-audit
- osv-scanner
- cve-database
- sbom
- supply-chain-security
brokers_frameworks:
- pip-audit
- OSV Database
- PyPA Advisory DB
- Python Dataclasses
version: "1.0.0"
author: algo-trading-skills-contributors
license: Apache-2.0
---

## When to Use

Use this skill in continuous integration (CI/CD) pipelines, automated build checks, and production trading system deployments. Third-party Python dependencies (such as `requests`, `urllib3`, `cryptography`, `pyyaml`) frequently contain security vulnerabilities (Remote Code Execution, Denial of Service, SQL injection). Deploying vulnerable packages to production trading servers exposes trade execution APIs and private keys to compromise. This module audits lockfiles against CVE databases and hard-fails CI builds on `CRITICAL` or `HIGH` severity flaws.

## Prerequisites

- Dependency inventory (`package_name`, `current_version`).
- CVE Advisory Database rules (`cve_id`, `package_name`, `vulnerable_spec`, `cvss_score`, `severity`, `recommended_version`).

## Workflow

1. **Lockfile & Inventory Parsing**:
   - Parse package names and installed versions.
2. **Advisory Match Engine**:
   - Evaluate package version against CVE advisory rules (OSV / PyPA DB).
   - Classify severity (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`).
3. **CI Pipeline Gate & Remediation**:
   - If `CRITICAL` or `HIGH` vulnerabilities detected $\implies$ Set `is_ci_build_passed = False` and block deployment.
   - Emit exact package upgrade remediation directives (e.g. "Upgrade `requests` 2.25.0 $\to$ 2.31.0").
4. **Audit Report Generation**: Output structured `VulnerabilityScanReport`.

> Full procedure: see `references/workflows.md`.
> Standards reference: see `references/standards.md`.
> Printable pre-flight checklist: see `assets/checklist.md`.

## Common Pitfalls

- **Ignoring Transitive Sub-Dependencies**: Scanning top-level packages while missing vulnerable transitive dependencies nested in `requirements.txt`.
- **Soft Warnings on Critical RCE Vulnerabilities**: Issuing non-blocking warnings for `CRITICAL` (CVSS $\ge 9.0$) vulnerabilities, allowing compromised builds to reach production.
- **Outdated CVE Databases**: Running CI security scans without updating the advisory database feed.

## Verification

- Instantiate `DependencyVulnerabilityScannerEngine`. Register CVE-2023-32681 (`requests < 2.31.0`, CVSS 7.5 HIGH). Audit a project with `requests==2.25.0` and `numpy==1.26.4`. Verify scanner flags `HIGH` severity vulnerability, sets `is_ci_build_passed = False`, and recommends upgrading `requests` to `2.31.0`.
- Run `python scripts/test_dependency_vulnerability_scanner.py`.

## Related Skills

- `dependency-pinning-and-reproducible-builds`
- `smart-contract-audit-requirements-before-defi-integration`
---