vuls-linux-cve-scanner

name	vuls-linux-cve-scanner
description	用于通过 Vuls 对 Linux、FreeBSD、容器、WordPress、库和网络设备执行 Agentless CVE 扫描。
zh_description	用于通过 Vuls 对 Linux、FreeBSD、容器、WordPress、库和网络设备执行 Agentless。
version	1.0.0
author	seaworld008
source	in-house
source_url
tags	[security, linux, cve, vuls, vulnerability-scanning, freebsd, host-security, patch-management]
created_at	2026-05-20
updated_at	2026-05-20
quality	4
complexity	advanced

Vuls Linux CVE Scanner

Trigger / When to Use

Use this skill when the user wants Linux or FreeBSD host vulnerability scanning, agentless CVE assessment over SSH, local host scans, package patch status review, or server fleet vulnerability reporting with Vuls.

Good trigger phrases:

• "scan Linux servers for CVEs"
• "check Ubuntu host vulnerabilities"
• "agentless CVE scan over SSH"
• "scan FreeBSD packages"
• "use Vuls for patch management"
• "audit servers against NVD and OVAL"

Core Capabilities

• Agentless vulnerability scanning for Linux and FreeBSD.
• Remote scan mode through SSH from a central scanner.
• Local scan mode when SSH from the scanner is not desired.
• Fast scan mode with low target impact.
• Deep scan mode for richer package and changelog evidence.
• Vulnerability matching from NVD, OVAL, JVN, RHSA, ALAS, ELSA, FreeBSD-SA, and changelog sources depending on target OS.
• Reports for host patch prioritization and remediation planning.

Workflow

1. Confirm Authorization and Scope

Before scanning hosts, confirm:

• Hostnames or inventory source.
• SSH access method and privilege level.
• Allowed scan window.
• Whether root privileges are allowed.
• Whether the scanner may fetch vulnerability databases from the internet.
• Output handling requirements because host package inventories are sensitive.

Never scan hosts outside the user's authorized scope.

2. Choose Scan Mode

Use:

• Fast remote scan for broad, low-impact fleet checks.
• Deep scan for high-value servers where detailed package evidence matters.
• Local scan for isolated hosts or environments that cannot accept SSH from the scanner.
• Containerized Vuls setup when the user wants a quick controlled runtime.

3. Prepare Data Sources

Vuls needs vulnerability intelligence before reliable scanning. Depending on setup, prepare:

• NVD.
• JVN.
• OVAL feeds for the target distributions.
• Vendor advisories such as RHSA, ALAS, ELSA, or FreeBSD-SA.

With Vulsctl-style Docker workflows, use the official tutorial commands as the source of truth and avoid inventing feed paths.

4. Define Targets

Create a minimal target config:

[servers]

[servers.web01]
 = 
 = 
 = 
 =