security-scanning-security-dependencies
掃描依賴項中的漏洞
自動掃描 npm、pip、Go 和 Rust 生態系統中的專案依賴項，以識別安全漏洞、生成 SBOM（軟體物料清單）並創建修復計劃。
스킬 ZIP 다운로드
Claude에서 업로드
설정 → 기능 → 스킬 → 스킬 업로드로 이동
토글을 켜고 사용 시작
테스트해 보기
"security-scanning-security-dependencies" 사용 중입니다. Scan dependencies for vulnerabilities
예상 결과:
- 在 2 個生態系統中發現 15 個漏洞
- 關鍵：2 | 高：5 | 中：6 | 低：2
- 關鍵漏洞：
- • lodash < 4.17.21 - CVE-2021-23337 - 已於 4.17.21 修復
- • moment < 2.29.4 - CVE-2022-24785 - 已於 2.29.4 修復
- 執行 'npm audit fix' 以套用可用的修補程式
"security-scanning-security-dependencies" 사용 중입니다. Generate SBOM
예상 결과:
- SBOM 已生成（CycloneDX 1.5）
- 元件：47 個函式庫
- 生態系統：npm (32)、pip (15)
- 匯出格式：JSON 可用
보안 감사
안전This is a legitimate defensive security skill for scanning project dependencies across multiple ecosystems (npm, pip, go, cargo). The static analyzer detected patterns typical of security tooling: subprocess calls to run standard vulnerability scanners (npm audit, safety, govulncheck, cargo audit), network requests to public vulnerability databases, and filesystem operations for reading project files. All detected patterns are legitimate security best practices with no malicious intent. The skill helps users identify vulnerable dependencies, generate SBOMs, and create remediation plans.
중간 위험 문제 (1)
위험 요인
감지된 패턴
품질 점수
만들 수 있는 것
發布前安全稽核
在發布前掃描所有專案依賴項，以識別並修復關鍵漏洞
CI/CD 流程整合
將自動化依賴項掃描整合到持續整合流程中，以便早期發現漏洞
合規 SBOM 生成
生成軟體物料清單以符合合規要求並提升供應鏈透明度
이 프롬프트를 사용해 보세요
Scan the dependencies in this project for vulnerabilities. Check npm, Python, Go, and Rust dependencies if present.
Generate a Software Bill of Materials (SBOM) in CycloneDX format for this project. Include all dependencies from detected ecosystems.
List all critical and high severity vulnerabilities found in the dependencies. For each, show the package name, current version, fixed version, and CVE if available.
Create a prioritized remediation plan for all vulnerabilities found. Group by severity and suggest upgrade paths for each affected package.
모범 사례
- 定期執行依賴項掃描，理想情況下透過 CI/CD 在每次提交時進行
- 優先修復關鍵和高嚴重性漏洞
- 更新依賴項後務必測試您的應用程式
- 維護最新的 SBOM 以符合合規要求並協助事件回應
피하기
- 未經適當風險評估請勿忽略漏洞警告
- 在檢視變更之前避免執行自動修復
- 不要因時間壓力而跳過掃描 - 漏洞可能被利用
- 未經測試切勿提交更新後的鎖定檔案