菜单
Guide automated security scanning, dependency auditing, and secret detection. Use when: dependency audit, CVE scanning, secret detection, license compliance. Keywords: scan, audit, CVE, dependency, secret, SBOM, vulnerability.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/AsiaOstrich/universal-dev-standards --skill scan命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
[UDS] 以 Claude 原生 Agent tool 编排多任务执行计划（DAG-based，无外部引擎）。 Use when: executing a plan.json file with parallel/sequential task dependencies. Keywords: orchestrate, plan, execute, DAG, task plan, 编排, 执行计划, 并行.
[UDS] 从 Spec 文档、OpenSpec 变更或自由文本需求生成 plan.json。 Use when: converting specifications into executable task plans for /orchestrate. Keywords: plan, spec, task plan, 计划, 规格, 任务, plan.json, DAG.
[UDS] AI 辅助 git push 安全层：质量门禁 + 协作护栏。 Use when: pushing commits, force pushing, pushing to protected branches, pushing feature branches. Keywords: git push, force push, protected branch, quality gate, push receipt, PR automation, 推送, 保护分支, 质量门禁.
正在显示 SKILL.md
基于 SOC 职业分类
| name | scan |
| scope | universal |
| description | Guide automated security scanning, dependency auditing, and secret detection. Use when: dependency audit, CVE scanning, secret detection, license compliance. Keywords: scan, audit, CVE, dependency, secret, SBOM, vulnerability. |
| allowed-tools | Read, Grep, Glob, Bash(npm:audit, npx:*) |
| argument-hint | [scan type or target | 掃描類型或目標] |
Automate security scanning for dependencies, secrets, and license compliance.
自動化相依套件、機密資訊和授權合規的安全掃描。
| Type | Tool Examples | Purpose | 用途 |
|---|---|---|---|
| Dependency audit | npm audit, pip-audit, Snyk | Find known CVEs in dependencies | 檢測相依套件已知 CVE |
| Secret detection | gitleaks, trufflehog | Find leaked credentials in code | 偵測程式碼中洩漏的憑證 |
| License compliance | license-checker, SPDX | Verify OSS license compatibility | 驗證開源授權相容性 |
| SAST | Semgrep, CodeQL | Static analysis for code patterns | 靜態分析程式碼模式 |
| Tool | Command | Scope | 範圍 |
|---|---|---|---|
| npm audit | npm audit --json | Node.js dependencies | Node.js 相依套件 |
| Snyk | npx snyk test | Multi-language deps | 多語言相依套件 |
| Trivy | trivy fs . | Filesystem & containers | 檔案系統與容器 |
| gitleaks | gitleaks detect | Git history secrets | Git 歷史機密 |
| SPDX | npx spdx-tool | License SBOM generation | 授權 SBOM 產出 |
| Severity | SLA | Criteria | 標準 |
|---|---|---|---|
| Critical | 24 hours | RCE, auth bypass, data exfil | 遠端執行、認證繞過、資料外洩 |
| High | 72 hours | Privilege escalation, SQLi | 權限提升、SQL 注入 |
| Medium | 2 weeks | XSS, CSRF, info disclosure | XSS、CSRF、資訊洩漏 |
| Low | Next sprint | Missing headers, verbose errors | 缺少 Header、冗長錯誤訊息 |
SCAN ──► TRIAGE ──► PRIORITIZE ──► FIX ──► VERIFY
/scan - Full scan (deps + secrets + license) | 完整掃描
/scan --deps - Dependency audit only | 僅相依套件審計
/scan --secrets - Secret detection only | 僅機密偵測
/scan --license - License compliance check | 授權合規檢查
After /scan completes, the AI assistant should suggest:
掃描完成。建議下一步 / Scan complete. Suggested next steps:
- 執行
/security深入安全審查 ⭐ Recommended / 推薦 — Run deep security review- 執行
/checkin確認修復符合提交規範 — Verify fixes meet check-in standards- 執行
/commit提交安全修復 — Commit security fixes- 更新相依套件 →
npm update或pip install --upgrade— Update dependencies
| Version | Date | Changes | 變更說明 |
|---|---|---|---|
| 1.0.0 | 2026-03-23 | Initial release | 初始版本 |
完整的 AI 行為定義請參閱對應的命令文件：
/scanFor complete AI agent behavior definition, see the corresponding command file:
/scan
CC BY 4.0 — Documentation content