asiaostrich/locales/zh-CN/skills/security-scan-assistant
locales/zh-CN/skills/security-scan-assistant/SKILL.md
引导自动化安全扫描、依赖包审计和机密检测。 使用时机：依赖审计、CVE 扫描、机密检测、许可证合规。 关键字：scan, audit, CVE, dependency, secret, SBOM, vulnerability, 扫描, 漏洞。
$ install --global
skillsauthnpx skillsauth add asiaostrich/universal-dev-standards locales/zh-CN/skills/security-scan-assistantInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 3, 2026, 10:51 AM5.1s1 file scanned
SKILL.md
- source:
- ../../../../skills/security-scan-assistant/SKILL.md
- source_version:
- 1.0.0
- translation_version:
- 1.0.0
- last_synced:
- 2026-03-23
- status:
- current
- description:
- |
安全扫描助手
语言: English | 简体中文
自动化依赖包、机密信息和许可证合规的安全扫描。
扫描类型
| 类型 | 工具范例 | 用途 | |------|----------|------| | 依赖包审计 | npm audit, pip-audit, Snyk | 检测已知 CVE | | 机密检测 | gitleaks, trufflehog | 检测泄露的凭证 | | 许可证合规 | license-checker, SPDX | 验证开源许可证兼容性 | | SAST | Semgrep, CodeQL | 静态分析代码模式 |
工具整合
| 工具 | 命令 | 范围 |
|------|------|------|
| npm audit | npm audit --json | Node.js 依赖包 |
| Snyk | npx snyk test | 多语言依赖包 |
| Trivy | trivy fs . | 文件系统与容器 |
| gitleaks | gitleaks detect | Git 历史机密 |
| SPDX | npx spdx-tool | 许可证 SBOM 产出 |
严重程度分类与 SLA
| 严重程度 | SLA | 标准 | |----------|-----|------| | Critical | 24 小时 | 远程执行、认证绕过、数据外泄 | | High | 72 小时 | 权限提升、SQL 注入 | | Medium | 2 周 | XSS、CSRF、信息泄露 | | Low | 下个 Sprint | 缺少 Header、冗长错误信息 |
工作流程
SCAN ──► TRIAGE ──► PRIORITIZE ──► FIX ──► VERIFY
使用方式
/scan- 完整扫描（依赖包 + 机密 + 许可证）/scan --deps- 仅依赖包审计/scan --secrets- 仅机密检测/scan --license- 许可证合规检查
下一步引导
/scan 完成后，AI 助手应建议：
扫描完成。建议下一步：
- 执行
/security深入安全审查- 执行
/checkin确认修复符合提交规范- 执行
/commit提交安全修复- 更新依赖包 →
npm update或pip install --upgrade
参考
- 核心规范：security-standards.md
Related Skills
asiaostrich/spec-derive
tools
VerifiedTrustedCommunity
[UDS] 從規格衍生 BDD 場景、TDD 骨架或 ATDD 表格
71SKILL.mdUpdated May 30, 2026
asiaostrich/methodology
development
VerifiedTrustedCommunity
[UDS] /methodology: 選擇並追蹤開發方法論（SDD/BDD/TDD）。 Use when: 選擇方法論、切換開發模式、查詢當前方法論狀態。 若要查詢各階段對應指令請用 /dev-workflow。
71SKILL.mdUpdated May 30, 2026
asiaostrich/spec-derive
testing
VerifiedTrustedCommunity
[UDS] Derive BDD scenarios, TDD skeletons, or ATDD tables from specifications
71SKILL.mdUpdated May 4, 2026
asiaostrich/sdd
development
VerifiedTrustedCommunity
[UDS] Create or review specification documents for Spec-Driven Development
71SKILL.mdUpdated Apr 3, 2026