---
name: "owasp-dependency-check-maven"
description: "Detect publicly disclosed CVE vulnerabilities in project dependencies using OWASP tool."
metadata:
  author: "OWASP"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run owasp dependency check"
  - "generate nvd cve report"
  - "configure dependency check maven"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# OWASP Dependency-Check CVE Vulnerability Analyzer

Analyzes software dependencies using OWASP Dependency-Check: matching project binaries and libraries against the National Vulnerability Database (NVD) with Common Platform Enumeration (CPE).

## When to Invoke
Invoke this skill whenever you need to:
- run owasp dependency check
- generate nvd cve report
- configure dependency check maven

## Execution SOP & Rules
1. Add dependency-check-maven plugin to pom.xml or execute the dependency-check CLI.
2. Configure failBuildOnCVSS threshold (e.g. 7.0 for High/Critical issues).
3. Maintain an active NVD API key to prevent rate limiting during database updates.
4. Document false positive suppressions with explicit rationale in suppression.xml.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.