Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill osv-scannerEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | osv-scanner |
| description | 用于通过 OSV-Scanner 检查锁文件、清单、SBOM、Git 历史和源码树中的开源依赖漏洞。 |
| zh_description | 用于通过 OSV-Scanner 检查锁文件、清单、SBOM、Git 历史和源码树中的开源依赖漏洞。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, dependency-scanning, cve, osv, sca, sbom, lockfiles, supply-chain] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | intermediate |
Use this skill when the user wants a fast open-source dependency vulnerability scan based on the OSV database, especially for projects with lockfiles, package manifests, SBOMs, or git repositories.
Good trigger phrases:
Determine whether the user wants to scan:
Prefer scanning lockfiles when present because they represent resolved dependency versions.
osv-scanner --version
If it is missing, recommend the official OSV-Scanner installation method for the user's platform.
Use source scanning for normal repositories:
osv-scanner scan source .
Scan a specific lockfile or manifest:
osv-scanner scan source --lockfile package-lock.json .
Scan an SBOM:
osv-scanner scan source -L sbom.spdx.json .
Use JSON when the result needs to feed automation:
osv-scanner scan source --format json --output osv-results.json .
If the installed version does not support a flag exactly as written, run osv-scanner --help and adapt to the installed CLI syntax.
For each finding, record:
Prioritize:
Use the package manager native workflow first:
npm audit fix
go get module@example.com@patched-version
pip-compile --upgrade-package package-name
cargo update -p package-name
bundle update package-name
When no fixed version exists:
name: osv-scanner
on: [pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install OSV-Scanner
run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
- name: Scan dependencies
run: osv-scanner scan source .
1. List package roots and lockfiles.
2. Scan from repository root.
3. Re-run targeted scans for high-risk services.
4. Deduplicate repeated findings by package/version/vulnerability ID.
5. Assign owners based on package root.
## OSV Finding
- Package:
- Ecosystem:
- Current version:
- Fixed version:
- Vulnerability:
- Direct/transitive:
- Lockfile:
- Recommended action:
- Risk owner: