菜单
Analyzes project dependencies for known security vulnerabilities using npm audit, pip-audit, or similar tools. Use when auditing packages, checking for CVEs, or updating vulnerable dependencies.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Creates and validates Azure Resource Manager (ARM) templates for infrastructure deployment. Use when creating ARM templates, deploying Azure infrastructure as code, or validating Azure templates.
Analyzes Azure costs and provides optimization recommendations including reserved instances, rightsizing, and unused resources. Use when optimizing Azure spending or analyzing Azure costs.
Creates dbt models with proper layering (staging, marts), incremental strategies, and documentation. Use when creating dbt models, organizing data transformations, or implementing incremental models.
Generates dbt tests including schema tests, data quality tests, and freshness checks. Use when adding tests to dbt models or implementing data quality validation.
Configures Google Cloud Build pipelines with caching, parallel builds, and optimization. Use when setting up Cloud Build, optimizing build performance, or configuring CI/CD pipelines.
Analyzes GCP costs and provides optimization recommendations including committed use discounts, rightsizing, and unused resources. Use when optimizing GCP spending or analyzing GCP costs.
| name | dependency-audit |
| description | Analyzes project dependencies for known security vulnerabilities using npm audit, pip-audit, or similar tools. Use when auditing packages, checking for CVEs, or updating vulnerable dependencies. |
Audit dependencies based on project type:
# Node.js
npm audit
# Python
pip-audit
# Go
govulncheck ./...
Check for manifest files:
package.json / package-lock.json → npm/yarnrequirements.txt / pyproject.toml → pipgo.mod → Go modulesCargo.toml → Cargo (Rust)Gemfile → Bundler (Ruby)Node.js (npm):
npm audit
npm audit --json # Machine-readable output
Node.js (yarn):
yarn audit
yarn audit --json
Python:
pip install pip-audit
pip-audit
pip-audit -r requirements.txt
Go:
govulncheck ./...
Ruby:
bundle audit check --update
Categorize by severity:
| Severity | CVSS | Action |
|---|---|---|
| Critical | 9.0+ | Update immediately |
| High | 7.0-8.9 | Update within 24h |
| Moderate | 4.0-6.9 | Update this sprint |
| Low | < 4.0 | Update when convenient |
npm - Auto-fix:
npm audit fix
npm audit fix --force # Breaking changes allowed
npm - Manual update:
npm update vulnerable-package
# or specific version
npm install vulnerable-package@2.0.0
Python - Update package:
pip install --upgrade vulnerable-package
# or pin safe version in requirements.txt
vulnerable-package>=2.0.0
Re-run audit to confirm:
npm audit # Should show 0 vulnerabilities
pip-audit # Should show no issues
When vulnerability is in a sub-dependency:
# Check dependency tree
npm ls vulnerable-package
# Force resolution (npm)
# Add to package.json:
{
"overrides": {
"vulnerable-package": "2.0.0"
}
}
When no patched version exists:
When fix requires major version bump:
## Dependency Audit Report
**Project:** my-app
**Date:** 2024-01-15
**Total Dependencies:** 245
**Vulnerabilities Found:** 3
### Critical (1)
**lodash** - Prototype Pollution
- Installed: 4.17.15
- Fixed in: 4.17.21
- CVE: CVE-2021-23337
- Fix: `npm install lodash@4.17.21`
### High (1)
**axios** - SSRF Vulnerability
- Installed: 0.21.0
- Fixed in: 0.21.2
- CVE: CVE-2021-3749
- Fix: `npm install axios@0.21.2`
### Moderate (1)
**minimist** - Prototype Pollution
- Installed: 1.2.5
- Fixed in: 1.2.6
- CVE: CVE-2021-44906
- Fix: `npm audit fix`
- name: Audit dependencies
run: |
npm audit --audit-level=high
# Fails if high or critical vulnerabilities found
# package.json scripts
{
"scripts": {
"precommit": "npm audit --audit-level=moderate"
}
}