菜单
Scan dependencies for known CVEs across ecosystems — npm audit, cargo audit, osv-scanner (multi-ecosystem, catches what npm audit misses), pip-audit. Triage by reachability (runtime vs dev) and severity before mass-bumping.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Route a task to the least intrusive executive-function support based on the user's stated current capacity, memory load, activation, and motivation. Use when work feels stuck, overwhelming, hard to hold in mind, or when the user asks for neurodivergent-friendly support without wanting a diagnostic or coaching ritual.
Reduce work to the smallest safe and useful outcome when capacity is low or burnout is present. Use when the user explicitly says they are depleted, overwhelmed, unable to start, or asks for the minimum viable version of a task.
Create a truthful activation bridge for a task that has low urgency, novelty, interest, challenge, or immediate feedback. Use when the user says they are stuck or avoiding a known task despite understanding it.
Reduce language, sensory, and uncertainty load while preserving complete information. Use when the user requests direct or scannable communication, has low capacity, is navigating a new flow, or needs explicit expectations and examples.
Turn a vague, oversized, or initiation-resistant outcome into an executable sequence with a visible first action and definition of done. Use when dependencies are hidden, the task spans multiple systems, or the user cannot identify where to begin.
Externalize time, checkpoints, stopping rules, and context transitions. Use when estimates are uncertain, a task may expand indefinitely, the user is switching topics, or an interruption risks losing the current state.
| name | dependency-audit |
| description | Scan dependencies for known CVEs across ecosystems — npm audit, cargo audit, osv-scanner (multi-ecosystem, catches what npm audit misses), pip-audit. Triage by reachability (runtime vs dev) and severity before mass-bumping. |
| created | "2026-06-27T00:00:00.000Z" |
| updated | "2026-06-27T00:00:00.000Z" |
| tags | ["security","dependencies","cve","vulnerability","npm-audit","cargo-audit","osv-scanner","supply-chain"] |
Most of your attack surface is code you didn't write. This scan finds dependencies with known CVEs (the published ones — a database lookup, not analysis). The trap is reacting to the severity number alone: a 9.8 in a dev-only test runner is not a 9.8 in your shipped runtime. Triage by reachability first, severity second.
# Node / TS — runtime only first (what you actually ship), then everything.
npm audit --omit=dev # the deps that ship in `npm install --omit=dev`
npm audit # + dev/build tooling
# Rust
cargo audit # reads Cargo.lock against the RustSec advisory DB
# Python
pip-audit # or: pip-audit -r requirements.txt
# Multi-ecosystem, recursive — the thorough net. Catches lockfiles the per-tool
# audits miss (sub-projects, docs sites) and flags dev deps explicitly.
osv-scanner scan source --recursive .
osv-scanner is the most complete — it walks every lockfile in the tree (including a docs site or sub-package the per-ecosystem tools never see) and labels (dev) so you can triage by reachability.
For each finding, ask in order:
(dev) dep (esbuild, vite, vitest, a linter) is NOT in your runtime if you install with --omit=dev. Real, but low urgency — it can't be hit by a user of the shipped artifact. Note it; don't panic-bump.npm audit fix, cargo update -p <crate>) — safe, same major version. Do this freely.audit fix --force before a release.overrides in package.json, [patch] in Cargo) when the direct dep hasn't updated yet.SECURITY.md or an allowlist so the next audit doesn't re-litigate it. Silent acceptance reads as "missed it."This finds known, published CVEs only — a zero-day or an unreported backdoor won't show. It's necessity, not sufficiency. Pair with [[sast-scan]] (your own code) and [[secret-scan]] (leaked credentials). Log what you deferred and why — see [[security-preflight]].