Skip to content

v1.5.1 - Web Dependency Security Scanning

Choose a tag to compare

View all tags
@charlesjones-dev charlesjones-dev released this 01 Nov 19:04
· 49 commits to main since this release
v1.5.1
48b3f99

🔒 Web Dependency Security Scanning

This release adds comprehensive web dependency security scanning capabilities to the ai-security plugin, enabling URL-based security analysis of deployed websites without requiring source code access.

✨ What's New

/security-scan-dependencies Command

Scan any deployed website for outdated dependencies, known CVEs, and security misconfigurations:

/security-scan-dependencies
# Enter target URL (e.g., https://example.com)
# Select scan scope: libraries, CMS, security headers, or comprehensive
# Get detailed security report with CVE analysis and remediation steps

🎯 Key Features

  • 🌐 URL-Based Scanning: Analyze deployed websites without source code access
  • 📚 Frontend Library Detection: jQuery, React, Vue, Angular, Bootstrap, Tailwind, and 20+ libraries
  • 🏢 CMS Platform Identification: WordPress, Drupal, Joomla, Sitecore, Umbraco, Optimizely, Kentico
  • 🔒 Security Headers Audit: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
  • 🔍 CVE Detection: Known vulnerability identification with CVSS v3.1 severity scoring
  • ⚡ Context7 Integration: Latest version verification via MCP tools
  • 📊 Comprehensive Reports: Timestamped reports with severity-based findings (C-001, H-001, M-001, L-001)

🎪 Architecture

  • Agent: security-dependency-scanner - Specialized agent for web scanning
  • Skill: security-dependency-scanning - Complete methodology for dependency analysis
  • Command: /security-scan-dependencies - Interactive URL-based scanning

💼 Use Cases

  • Third-party website security assessment
  • Pre-acquisition technical due diligence
  • Client-side dependency auditing
  • Supply chain security analysis
  • External security posture evaluation

📦 What's Included

AI-Security Plugin v1.3.0

  • New command: /security-scan-dependencies
  • New agent: security-dependency-scanner
  • New skill: security-dependency-scanning
  • Updated documentation with comparison tables and use cases

Repository Updates

  • Added .gitignore for environment, OS, and IDE files
  • Marketplace updated to v1.5.1
  • Comprehensive changelog and documentation updates

🔄 Comparison with /security-audit

Feature /security-audit /security-scan-dependencies
Input Local source code Website URL
Analysis Static code analysis Client-side dependency analysis
Detects Code vulnerabilities, OWASP Top 10 Outdated libraries, CVEs, headers
Use Case Your own codebases Third-party websites
Assets 2
Loading