Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill osv-scannerLa commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Basé sur la classification professionnelle SOC
Affichage de SKILL.md
| name | osv-scanner |
| description | 用于通过 OSV-Scanner 检查锁文件、清单、SBOM、Git 历史和源码树中的开源依赖漏洞。 |
| zh_description | 用于通过 OSV-Scanner 检查锁文件、清单、SBOM、Git 历史和源码树中的开源依赖漏洞。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, dependency-scanning, cve, osv, sca, sbom, lockfiles, supply-chain] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | intermediate |
Use this skill when the user wants a fast open-source dependency vulnerability scan based on the OSV database, especially for projects with lockfiles, package manifests, SBOMs, or git repositories.
Good trigger phrases:
Determine whether the user wants to scan:
Prefer scanning lockfiles when present because they represent resolved dependency versions.
osv-scanner --version
If it is missing, recommend the official OSV-Scanner installation method for the user's platform.
Use source scanning for normal repositories:
osv-scanner scan source .
Scan a specific lockfile or manifest:
osv-scanner scan source --lockfile package-lock.json .
Scan an SBOM:
osv-scanner scan source -L sbom.spdx.json .
Use JSON when the result needs to feed automation:
osv-scanner scan source --format json --output osv-results.json .
If the installed version does not support a flag exactly as written, run osv-scanner --help and adapt to the installed CLI syntax.
For each finding, record:
Prioritize:
Use the package manager native workflow first:
npm audit fix
go get module@example.com@patched-version
pip-compile --upgrade-package package-name
cargo update -p package-name
bundle update package-name
When no fixed version exists:
name: osv-scanner
on: [pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install OSV-Scanner
run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
- name: Scan dependencies
run: osv-scanner scan source .
1. List package roots and lockfiles.
2. Scan from repository root.
3. Re-run targeted scans for high-risk services.
4. Deduplicate repeated findings by package/version/vulnerability ID.
5. Assign owners based on package root.
## OSV Finding
- Package:
- Ecosystem:
- Current version:
- Fixed version:
- Vulnerability:
- Direct/transitive:
- Lockfile:
- Recommended action:
- Risk owner: