Snyk Vulnerability Scanner
by @cr0m3
Automates Snyk security vulnerability scanning, GitHub issue reporting, and auto-fix PR creation for repositories. Use when scanning repositories for securit...
clawhub install snyk-vulnerability-scannerπ About This Skill
name: snyk-vulnerability-scanner description: Automates Snyk security vulnerability scanning, GitHub issue reporting, and auto-fix PR creation for repositories. Use when scanning repositories for security vulnerabilities, generating vulnerability reports as GitHub issues, or automatically fixing vulnerabilities via pull requests. Requires Snyk CLI authentication, GitHub CLI authentication, and repository access permissions. Supports npm, Python, Gradle, and Maven projects. Creates PRs against dev branch by default.
Snyk Vulnerability Scanner
Automated security vulnerability scanning and fixing for GitHub repositories using Snyk.
What It Does
1. Scans repositories for security vulnerabilities using Snyk 2. Reports findings as GitHub issues (grouped by package) 3. Auto-fixes vulnerabilities by applying Snyk patches and creating PRs
Prerequisites
Before using this skill, ensure:
1. Snyk CLI is installed: npm install -g snyk and authenticated: snyk auth
2. GitHub CLI is installed: brew install gh and authenticated: gh auth login
3. jq is installed: brew install jq (for JSON processing)
4. You have write access to the target repository
Workflow
Scan Repository β Create GitHub Issues β Auto-Fix β Create PR
Severity Levels
critical - Critical vulnerabilities onlyhigh - High and critical vulnerabilities (default)medium - Medium, high, and criticallow - All severitiesUsage
Full Automated Workflow
Run complete scan β report β fix workflow:
./scripts/run-full-workflow.sh [base-branch] [severity] [skip-issues] [skip-fix] [dry-run]
Parameters:
repo-url - Full GitHub URL (required)base-branch - Target branch for PRs (default: dev)severity - Comma-separated levels (default: high,critical)skip-issues - true to skip GitHub issue creation (default: false)skip-fix - true to skip auto-fix (default: false)dry-run - true to simulate without making changes (default: false)Examples:
# Full workflow with defaults
./scripts/run-full-workflow.sh https://github.com/owner/repoScan only, skip fixes
./scripts/run-full-workflow.sh https://github.com/owner/repo dev high false true falseDry run - everything but no changes
./scripts/run-full-workflow.sh https://github.com/owner/repo dev high,critical false false trueFix only (skip issues), target main branch
./scripts/run-full-workflow.sh https://github.com/owner/repo main high true false false
Step-by-Step Usage
#### 1. Scan Only
./scripts/snyk-scan.sh [output-file] [severity-filter]
Generates a JSON file with vulnerability details.
Example:
./scripts/snyk-scan.sh https://github.com/owner/repo results.json high,critical
#### 2. Create GitHub Issues
python3 scripts/create-github-issues.py
Creates one GitHub issue per vulnerable package, grouping all CVEs for that package.
#### 3. Auto-Fix and Create PR
./scripts/snyk-auto-fix.sh [base-branch] [dry-run]
Applies Snyk fixes and creates a PR to the specified branch.
Example:
./scripts/snyk-auto-fix.sh https://github.com/owner/repo dev false
Supported Package Managers
package.json)requirements.txt, Pipfile, pyproject.toml)build.gradle)pom.xml)GitHub Issues
Issues are created with:
security, vulnerability, snykDuplicate prevention: Issues won't be created if a similar issue already exists for the same package.
Pull Requests
PRs include:
snyk-fix-security, dependencies, snykCron/Automated Runs
For periodic scans, use the skill via cron:
# Add to cron for daily scans at 9am
0 9 * * * cd ~/.openclaw/workspace/skills/snyk-vulnerability-scanner && ./scripts/run-full-workflow.sh https://github.com/owner/repo
Or via OpenClaw cron for direct integration:
{
"name": "snyk-daily-scan",
"schedule": { "kind": "cron", "expr": "0 9 * * *" },
"payload": {
"kind": "agentTurn",
"message": "Run Snyk vulnerability scan on https://github.com/owner/repo and create fixes for dev branch"
}
}
Scripts Reference
| Script | Purpose |
|--------|---------|
| run-full-workflow.sh | Main entry point - runs complete workflow |
| snyk-scan.sh | Scans repo, outputs JSON results |
| create-github-issues.py | Creates GitHub issues from scan results |
| snyk-auto-fix.sh | Applies fixes and creates PRs |
Troubleshooting
"Snyk not authenticated"
β Run: snyk auth
"GitHub CLI not authenticated"
β Run: gh auth login
"No vulnerabilities found" β Check Snyk dashboard for your project; may need to import repo first
"Permission denied" on scripts
β Run: chmod +x scripts/*.sh
Auto-fix not working β Some vulnerabilities can't be auto-fixed; check Snyk dashboard for remediation advice
Dry run shows changes but real run doesn't β Check that Snyk has fixable suggestions for the vulnerabilities; some require manual updates
π‘ Examples
Full Automated Workflow
Run complete scan β report β fix workflow:
./scripts/run-full-workflow.sh [base-branch] [severity] [skip-issues] [skip-fix] [dry-run]
Parameters:
repo-url - Full GitHub URL (required)base-branch - Target branch for PRs (default: dev)severity - Comma-separated levels (default: high,critical)skip-issues - true to skip GitHub issue creation (default: false)skip-fix - true to skip auto-fix (default: false)dry-run - true to simulate without making changes (default: false)Examples:
# Full workflow with defaults
./scripts/run-full-workflow.sh https://github.com/owner/repoScan only, skip fixes
./scripts/run-full-workflow.sh https://github.com/owner/repo dev high false true falseDry run - everything but no changes
./scripts/run-full-workflow.sh https://github.com/owner/repo dev high,critical false false trueFix only (skip issues), target main branch
./scripts/run-full-workflow.sh https://github.com/owner/repo main high true false false
Step-by-Step Usage
#### 1. Scan Only
./scripts/snyk-scan.sh [output-file] [severity-filter]
Generates a JSON file with vulnerability details.
Example:
./scripts/snyk-scan.sh https://github.com/owner/repo results.json high,critical
#### 2. Create GitHub Issues
python3 scripts/create-github-issues.py
Creates one GitHub issue per vulnerable package, grouping all CVEs for that package.
#### 3. Auto-Fix and Create PR
./scripts/snyk-auto-fix.sh [base-branch] [dry-run]
Applies Snyk fixes and creates a PR to the specified branch.
Example:
./scripts/snyk-auto-fix.sh https://github.com/owner/repo dev false
βοΈ Configuration
Before using this skill, ensure:
1. Snyk CLI is installed: npm install -g snyk and authenticated: snyk auth
2. GitHub CLI is installed: brew install gh and authenticated: gh auth login
3. jq is installed: brew install jq (for JSON processing)
4. You have write access to the target repository
π Tips & Best Practices
"Snyk not authenticated"
β Run: snyk auth
"GitHub CLI not authenticated"
β Run: gh auth login
"No vulnerabilities found" β Check Snyk dashboard for your project; may need to import repo first
"Permission denied" on scripts
β Run: chmod +x scripts/*.sh
Auto-fix not working β Some vulnerabilities can't be auto-fixed; check Snyk dashboard for remediation advice
Dry run shows changes but real run doesn't β Check that Snyk has fixable suggestions for the vulnerabilities; some require manual updates