Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

osv-scanner

Étoiles6

Forks2

Mis à jour3 juin 2026 à 05:58

[static-analysis] Scan lockfiles/SBOM/dependencies against the OSV database for known-vulnerable package versions. Reach for it in vuln-analysis to surface CVEs in third-party deps with fixed-version guidance.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

tr4m0ryp

tr4m0ryp/shor

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

SKILL.md

readonly

name	osv-scanner
description	[static-analysis] Scan lockfiles/SBOM/dependencies against the OSV database for known-vulnerable package versions. Reach for it in vuln-analysis to surface CVEs in third-party deps with fixed-version guidance.

osv-scanner — dependency vulnerability scanning

Google's osv-scanner (pure-Go). Reads lockfiles/SBOMs in the repo and matches dependency versions against the OSV.dev vulnerability database. Read-only, no target traffic → vuln-analysis phase. This is the software-composition (SCA) view: vulnerable libraries the app ships.

When to reach for it

Whitebox SCA pass over the connected repo's dependency manifests/lockfiles.
To enumerate known-CVE deps and the version that fixes each.

Key flags

scan source -r <path> recursively scan a project's lockfiles (newer CLI). Older/simple form: osv-scanner -r <path> or --lockfile <file>.
--sbom <file> scan a CycloneDX/SPDX SBOM.
--format json --output out.json structured output (also sarif, markdown).
--call-analysis (where supported) to reduce noise to reachable vulns.

Safe invocation

# Recursively scan repo lockfiles against OSV, JSON out
osv-scanner scan source -r /path/to/repo --format json --output osv.json

CLI surface shifted between versions; confirm with osv-scanner --help.

Evidence to capture

Per-vuln: package, installed version, OSV/CVE id, severity, fixed version.
Fixed-version + manifest path makes a clean, actionable remediation prompt.

Scope & rate caveats

Manifest/source only — no target rate or egress concern (OSV lookups may use a local DB or query osv.dev; honor any provider limits).
A vulnerable dep present ≠ exploitable in this app; note reachability where the tool can, and prefer it over raw version-match when available.
Scan only the in-scope checked-out repo.

Plus depuis ce dépôt

même dépôt

jwt-tool

tr4m0ryp/shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

2026-06-066

naabu

tr4m0ryp/shor

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

2026-06-066

trivy

tr4m0ryp/shor

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

2026-06-066

semgrep

tr4m0ryp/shor

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

2026-06-066

trufflehog

tr4m0ryp/shor

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

2026-06-066

gitleaks

tr4m0ryp/shor

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

2026-06-066

name	osv-scanner
description	[static-analysis] Scan lockfiles/SBOM/dependencies against the OSV database for known-vulnerable package versions. Reach for it in vuln-analysis to surface CVEs in third-party deps with fixed-version guidance.

osv-scanner — dependency vulnerability scanning

When to reach for it

Whitebox SCA pass over the connected repo's dependency manifests/lockfiles.
To enumerate known-CVE deps and the version that fixes each.

Key flags

scan source -r <path> recursively scan a project's lockfiles (newer CLI). Older/simple form: osv-scanner -r <path> or --lockfile <file>.
--sbom <file> scan a CycloneDX/SPDX SBOM.
--format json --output out.json structured output (also sarif, markdown).
--call-analysis (where supported) to reduce noise to reachable vulns.

Safe invocation

# Recursively scan repo lockfiles against OSV, JSON out
osv-scanner scan source -r /path/to/repo --format json --output osv.json

CLI surface shifted between versions; confirm with osv-scanner --help.

Evidence to capture

Per-vuln: package, installed version, OSV/CVE id, severity, fixed version.
Fixed-version + manifest path makes a clean, actionable remediation prompt.

Scope & rate caveats

Manifest/source only — no target rate or egress concern (OSV lookups may use a local DB or query osv.dev; honor any provider limits).
A vulnerable dep present ≠ exploitable in this app; note reachability where the tool can, and prefer it over raw version-match when available.
Scan only the in-scope checked-out repo.