# Vulnerability Scanner

Check software and services for known security weaknesses and understand which ones matter.

## Helpful when

- You are preparing a release or update.
- A dependency or container may be outdated.
- You need to review known weaknesses on a server or service.

## What to share with Pi

- Dependency files, software versions, images, or service details
- Where and how the software is used
- Any existing scan output

## Try asking

> Check these dependencies and this container image for known vulnerabilities. Explain which findings are realistically exploitable and what to update first.

## What you’ll get

- Known issues ordered by practical risk
- Affected and fixed versions when available
- Upgrade, mitigation, and verification steps

## Keep in mind

Vulnerability databases can be incomplete or delayed, and version matches can create false alarms. Individual version and audit commands can be read-only, but saving reports or updating the host’s `MEMORY.md` watch list writes files. Optional setup or remediation may use `sudo`, install packages, or run an external installer; review and approve those effects first.

## Install

```bash
pi install npm:@firstpick/pi-skill-vulnerability-scanner
```

Restart Pi if the skill does not appear in your current session.

## Technical details

See [TECHNICAL.md](https://github.com/Firstp1ck/pi-coding-agent-forge/blob/main/pi-skill-vulnerability-scanner/TECHNICAL.md) for advanced usage, configuration, compatibility, and limitations.