Add dependency-scanning skill to advanced-security plugin

[MabCloud]

What's this?

A new dependency-scanning skill for the advanced-security plugin. Think of it as the sibling of the existing secret-scanning skill, but instead of looking for leaked credentials, it looks for known CVEs and security vulnerabilities in your project's dependencies.

How it works

When you ask something like "are there any vulnerabilities in my dependencies?" or "check my packages for CVEs", the agent will:

1. Auto-detect your ecosystem by looking for lock files in the project (package-lock.json, yarn.lock, pnpm-lock.yaml, Cargo.lock, Gemfile.lock, go.sum, *.csproj, etc.). Works with monorepos that have multiple ecosystems.
2. Run the right audit tool for each ecosystem — no configuration needed.
3. Report findings by severity (Critical → High → Moderate → Low) with CVE IDs, a short description, the advisory link, and the exact command to fix it.
4. Optionally cross-reference Dependabot alerts from GitHub if the repo has them enabled, using gh api or the REST API.

Supported ecosystems

Ecosystem	Tool used
npm
pm audit
Yarn Classic (v1)	yarn audit
Yarn Berry (v2+)	yarn npm audit
pnpm	pnpm audit
Python	pip-audit
Rust	cargo audit
Ruby	bundler-audit
Go	govulncheck
.NET	dotnet list package --vulnerable

Files changed

• plugins/advanced-security/skills/dependency-scanning/SKILL.md — the new skill
• plugins/advanced-security/README.md — updated to document the new skill
• .github/plugin/marketplace.json — registers dependency-scanning under the advanced-security plugin entry

[MabCloud]

@copilot