القائمة
Multi-language dependency security scan - Use Safety CLI and OSV-Scanner to quickly detect dependency vulnerabilities in Python/JS/Java projects
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
AI Agent code quality check - Use Ruff to check code standards for LangChain, AutoGen, and other AI Agent projects
Database migration management - Use Flyway and Atlas for version-controlled database schema migrations
Dockerfile best practices check - Use hadolint to validate Dockerfile security, performance, and compliance
Format JavaScript/TypeScript code with Prettier
Format Python code with Black
Auto-generate project changelog
| name | vuln-scan |
| description | Multi-language dependency security scan - Use Safety CLI and OSV-Scanner to quickly detect dependency vulnerabilities in Python/JS/Java projects |
Provides two lightweight vulnerability scanning tools:
| Tool | Installation (All Platforms) |
|---|---|
| Safety CLI | pip install safety |
| OSV-Scanner | Download |
Safety CLI Scan:
# Windows
.\.agent\skills\vuln-scan\scripts\safety-scan.ps1
# Linux/Mac
./.agent/skills/vuln-scan/scripts/safety-scan.sh
OSV-Scanner Scan:
# Windows
.\.agent\skills\vuln-scan\scripts\osv-scan.ps1
# Linux/Mac
./.agent/skills/vuln-scan/scripts/osv-scan.sh
CI/CD Mode:
.\.agent\skills\vuln-scan\scripts\safety-scan.ps1 -CI
# Sets exit code, breaks pipeline on failure
🔍 Vulnerability Scan - Safety CLI
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📦 Scanning: requirements.txt (23 dependencies)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
╭────────────────────────────────────────╮
│ ❌ VULNERABILITY FOUND │
├────────────────────────────────────────┤
│ Package: urllib3 │
│ Installed: 1.26.5 │
│ Affected: <1.26.18 │
│ ID: 51499 │
│ │
│ OWASP Top 10: A05:2021 - Security │
│ Misconfiguration │
│ │
│ Description: │
│ urllib3's request body can leak from │
│ URLError exceptions │
│ │
│ Fix: Upgrade to urllib3>=1.26.18 │
╰────────────────────────────────────────╯
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Scan Results:
🔴 Critical: 0
🟠 High: 1
🟡 Medium: 2
🟢 Low: 0
💡 Fix Suggestion:
pip install --upgrade urllib3>=1.26.18
.safety-policy.yml)# Security policy config
security:
# Ignore specific vulnerability IDs
ignore-vulnerabilities:
51499:
reason: "False positive - not using affected functionality"
expires: "2026-12-31"
# Ignore specific packages
ignore-packages:
- package: test-utils
reason: "Dev dependency only"
# Set CVSS threshold
continue-on-vulnerability-error: false
fail-security-check-threshold: 7.0
# Monitoring config
alert:
# Optional: Integrate Slack/Email alerts
on-vulnerability: slack
webhook: ${SAFETY_WEBHOOK_URL}
[[IgnoredVulns]]
id = "GHSA-xxxx-yyyy-zzzz"
reason = "Not applicable to our use case"
[[PackageOverrides]]
name = "example"
version = "1.0.0"
ecosystem = "npm"
ignore = true
Safety CLI Auto-upgrade:
# Generate fix commands
safety check --json | safety generate fixes
# Or apply fixes directly (use with caution)
safety check --apply-fixes
Manual Fix Examples:
# Python
pip install --upgrade package-name>=safe-version
# JavaScript
npm update package-name@safe-version
# Java (Maven)
# Modify version in pom.xml
name: Security Scan
on: [push, pull_request]
jobs:
safety-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: Install Safety
run: pip install safety
- name: Run Safety Check
run: safety check --json
env:
SAFETY_API_KEY: ${{ secrets.SAFETY_API_KEY }}
osv-scan:
image: golang:latest
script:
- go install github.com/google/osv-scanner/cmd/osv-scanner@latest
- osv-scanner --lockfile=package-lock.json
Q: Does Safety CLI require an API Key?
A: Free version has limits, recommend applying for free API Key: safety.com
Q: OSV-Scanner vs Safety CLI?
A:
Q: How to use in offline environments?
A: Safety CLI can download offline database; OSV-Scanner supports local caching
Q: Too many false positives?
A: Use config files to suppress known false positives, keep reason notes