メニュー
[static-analysis] Scan lockfiles/SBOM/dependencies against the OSV database for known-vulnerable package versions. Reach for it in vuln-analysis to surface CVEs in third-party deps with fixed-version guidance.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | osv-scanner |
| description | [static-analysis] Scan lockfiles/SBOM/dependencies against the OSV database for known-vulnerable package versions. Reach for it in vuln-analysis to surface CVEs in third-party deps with fixed-version guidance. |
Google's osv-scanner (pure-Go). Reads lockfiles/SBOMs in the repo and matches
dependency versions against the OSV.dev vulnerability database. Read-only, no
target traffic → vuln-analysis phase. This is the software-composition (SCA)
view: vulnerable libraries the app ships.
scan source -r <path> recursively scan a project's lockfiles (newer CLI).
Older/simple form: osv-scanner -r <path> or --lockfile <file>.--sbom <file> scan a CycloneDX/SPDX SBOM.--format json --output out.json structured output (also sarif, markdown).--call-analysis (where supported) to reduce noise to reachable vulns.# Recursively scan repo lockfiles against OSV, JSON out
osv-scanner scan source -r /path/to/repo --format json --output osv.json
CLI surface shifted between versions; confirm with
osv-scanner --help.