canonical/cve-scanner ? reverse-engineered prompt

Build me a small Python tool that scans a codebase for known CVEs and exports the results in a clean, usable format.

I want it to use Google’s osv scanner under the hood, then turn the findings into something easy to read or feed into other tools, like a JSON or similar report. It should work from the command line, take a target folder as input, and be simple enough to run locally or in CI. If there are no issues, it should say that clearly. If there are vulnerabilities, show the important details like package, affected version, severity, and any helpful references.

Please make it feel like a real finished utility, with a clean project structure, basic tests, and sensible error handling. If you need to check current docs for osv scanner or the best way to call it, feel free to look them up online first.