Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill osv-scannerO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baseado na classificação ocupacional SOC
Exibindo SKILL.md
| name | osv-scanner |
| description | 用于通过 OSV-Scanner 检查锁文件、清单、SBOM、Git 历史和源码树中的开源依赖漏洞。 |
| zh_description | 用于通过 OSV-Scanner 检查锁文件、清单、SBOM、Git 历史和源码树中的开源依赖漏洞。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, dependency-scanning, cve, osv, sca, sbom, lockfiles, supply-chain] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | intermediate |
Use this skill when the user wants a fast open-source dependency vulnerability scan based on the OSV database, especially for projects with lockfiles, package manifests, SBOMs, or git repositories.
Good trigger phrases:
Determine whether the user wants to scan:
Prefer scanning lockfiles when present because they represent resolved dependency versions.
osv-scanner --version
If it is missing, recommend the official OSV-Scanner installation method for the user's platform.
Use source scanning for normal repositories:
osv-scanner scan source .
Scan a specific lockfile or manifest:
osv-scanner scan source --lockfile package-lock.json .
Scan an SBOM:
osv-scanner scan source -L sbom.spdx.json .
Use JSON when the result needs to feed automation:
osv-scanner scan source --format json --output osv-results.json .
If the installed version does not support a flag exactly as written, run osv-scanner --help and adapt to the installed CLI syntax.
For each finding, record:
Prioritize:
Use the package manager native workflow first:
npm audit fix
go get module@example.com@patched-version
pip-compile --upgrade-package package-name
cargo update -p package-name
bundle update package-name
When no fixed version exists:
name: osv-scanner
on: [pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install OSV-Scanner
run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
- name: Scan dependencies
run: osv-scanner scan source .
1. List package roots and lockfiles.
2. Scan from repository root.
3. Re-run targeted scans for high-risk services.
4. Deduplicate repeated findings by package/version/vulnerability ID.
5. Assign owners based on package root.
## OSV Finding
- Package:
- Ecosystem:
- Current version:
- Fixed version:
- Vulnerability:
- Direct/transitive:
- Lockfile:
- Recommended action:
- Risk owner: