Nox-Lumen-tech
Nox-Lumen-tech/combo-skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Nox-Lumen-tech/combo-skills --skill spotbugs命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | spotbugs |
| description | Java 字节码级 Bug 检测 + FindSecBugs 安全扫描，检测空指针/资源泄漏/并发/OWASP |
| execution_mode | sandbox |
| metadata | {"language":"java","plugins":["findsecbugs"],"upstream":{"repo":"https://github.com/spotbugs/spotbugs","stars":3850,"findsecbugs_repo":"https://github.com/find-sec-bugs/find-sec-bugs","findsecbugs_stars":2400,"since":"2016 (FindBugs 传承自 2003)","license":"LGPL-2.1","latest":"4.9.8 (2025-10)","rules":"400+ core + 150+ security (FindSecBugs)","maven_downloads":"~600K/月","contributors":"200 + 70 (FindSecBugs)","notable_users":["Netflix","Atlassian","GitLab","Liferay"],"integrations":["Maven","Gradle","IntelliJ","Eclipse","SonarQube","MegaLinter"]},"rating":{"community":"3.5/5","rules_richness":"5/5","speed":"3/5","accuracy":"4.5/5","integration":"4/5","overall":"4.0/5 ⭐⭐⭐⭐"}} |
| 检查范围 | 对应需求原文 | SpotBugs 类别 |
|---|---|---|
| 空指针风险 | "空指针风险" | NP_NULL_ON_SOME_PATH, NP_DEREFERENCE_OF_READLINE_VALUE |
| 资源未释放 | "资源未释放" | OS_OPEN_STREAM, ODR_OPEN_DATABASE_RESOURCE |
| 并发问题 | 逻辑漏洞 | IS2_INCONSISTENT_SYNC, DC_DOUBLECHECK |
| SQL 注入 | "SQL注入" | FindSecBugs: SQL_INJECTION, SQL_INJECTION_JDBC |
| XSS | "XSS攻击" | FindSecBugs: XSS_REQUEST_WRAPPER, XSS_SERVLET |
| 硬编码密钥 | "敏感信息泄露" | FindSecBugs: HARD_CODE_PASSWORD, HARD_CODE_KEY |
CLI: spotbugs -textui -xml:withMessages -pluginList findsecbugs.jar -effort:max build/classes/
前提: 需先编译（mvn compile / gradle build）
桥接: violations-command-line PARSER=FINDBUGS → SARIF → reviewdog
Maven: com.github.spotbugs:spotbugs-maven-plugin + FindSecBugs find-sec-bugs/find-sec-bugs