菜单
Scans an audit reference for dangerous patterns: install hooks, encoded payloads, curl-pipe-bash, symlinks, git hooks, suspicious Makefiles, and other supply-chain threats. Use before adding or updating a ref, or on-demand to audit an existing ref. Does NOT modify any files.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | scan-ref |
| description | Scans an audit reference for dangerous patterns: install hooks, encoded payloads, curl-pipe-bash, symlinks, git hooks, suspicious Makefiles, and other supply-chain threats. Use before adding or updating a ref, or on-demand to audit an existing ref. Does NOT modify any files. |
| allowed-tools | ["Bash","Read","Grep","Glob"] |
Read-only security scanner. Checks for supply-chain threats before pinning.
# Full scan (local, ref must exist)
.claude/skills/scan-ref/scan_ref.sh <ref-name>
# Diff scan (only changes between two commits)
.claude/skills/scan-ref/scan_ref.sh <ref-name> <old-sha> <new-sha>
# Remote scan (safe-clones to temp dir, scans, cleans up — use before /add-ref)
.claude/skills/scan-ref/scan_ref.sh <ref-name> --url <repo-url> [<sha>]
| Severity | Pattern |
|---|---|
| CRITICAL | package.json install hooks, Python cmdclass, curl|bash, encoded payloads |
| HIGH | Git hooks (.husky/, .githooks/), symlinks escaping the repo, LLM instruction files |
| MEDIUM | Makefiles with suspicious commands, dangerous CI triggers, eval/exec in scripts |
| INFO | All executable files |
The scanner flags patterns, not intent. Security reference repos often contain curl | bash in documentation (describing attacks) or eval in analysis tools. Review each finding in context. CRITICAL in a .md is usually benign; CRITICAL in a .sh needs investigation.
Exit codes: 0 = clean, 1 = high findings, 2 = critical findings.
Initializes and pins all audit reference submodules after a fresh clone. Use when the user has just cloned the repository and needs to set up the submodules, or when submodules are missing or uninitialized. Do NOT use to update a ref to a new SHA (use update-ref) or to add a new ref (use add-ref).
Adds a new pinned audit reference (git submodule) to this repository. Use when the user wants to add an external repository as an audit reference, provides a GitHub URL to add, or asks to pin a new tool or methodology. Do NOT use for updating an existing ref's SHA (use update-ref) or re-adding a previously removed ref without explicit user confirmation.
Removes a pinned audit reference from this repository. Use when the user explicitly asks to remove, delete, or retire an audit reference. Requires a stated reason before proceeding. Do NOT use for updating a ref's SHA (use update-ref) or temporarily disabling a ref.
Updates the pinned SHA for an existing audit reference. Use when the user wants to upgrade or downgrade a ref to a different commit, asks to pull in new changes from an upstream repo, or wants to pin a ref to a specific SHA. Do NOT use for adding a brand new ref (use add-ref) or removing a ref entirely (use remove-ref).