菜单
Snyk Open Source-parity workflow for software composition analysis. Produces a dependency vulnerability report using open-source tooling (osv-scanner, trivy, grype) plus the bundled snyk CLI if authenticated. Use when the analyst is familiar with the Snyk workflow and wants a drop-in replacement.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
| name | snyk-sca |
| description | Snyk Open Source-parity workflow for software composition analysis. Produces a dependency vulnerability report using open-source tooling (osv-scanner, trivy, grype) plus the bundled snyk CLI if authenticated. Use when the analyst is familiar with the Snyk workflow and wants a drop-in replacement. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | snyk.io/product/open-source-security-management |
Snyk Open Source is a benchmark for SCA UX. This skill reproduces its key
workflows without requiring a Snyk license, and opportunistically uses the
Snyk CLI when SNYK_TOKEN is present.
# 1. Inventory manifests
find target -maxdepth 4 \( \
-name 'package.json' -o -name 'pnpm-lock.yaml' -o -name 'yarn.lock' \
-o -name 'requirements*.txt' -o -name 'poetry.lock' -o -name 'Pipfile.lock' \
-o -name 'go.mod' -o -name 'Cargo.toml' -o -name 'pom.xml' \
-o -name 'build.gradle*' -o -name 'composer.json' -o -name 'Gemfile.lock' \
\) -not -path '*/node_modules/*' -not -path '*/vendor/*'
# 2. Canonical scan (OSV = same vuln DB Snyk queries upstream for OSS)
osv-scanner --recursive --format sarif target/ > reports/sca-osv.sarif
# 3. Duplicate with Trivy FS for cross-validation (sometimes catches CVEs OSV
# doesn't yet have, and adds license info)
trivy fs --scanners vuln,license --format sarif target/ > reports/sca-trivy.sarif
# 4. If Snyk token present, add Snyk's own findings
if [ -n "$SNYK_TOKEN" ]; then
snyk test --all-projects --sarif-file-output=reports/sca-snyk.sarif target/ || true
fi
# 5. SBOM — CycloneDX & SPDX
syft target -o cyclonedx-json > reports/sbom.cdx.json
syft target -o spdx-json > reports/sbom.spdx.json
For each CVE:
semgrep --config=auto with the CVE's package in scopeosv-scanner output.npm outdated, pip list --outdated, cargo outdated.{
"file": "target/package-lock.json",
"line": 1024,
"severity": "HIGH",
"category": "vuln_dependency",
"description": "lodash < 4.17.21 — prototype pollution (CVE-2020-8203)",
"exploit_scenario": "Path 'src/utils/merge.ts:14' calls _.merge(req.body, …)",
"recommendation": "Upgrade to lodash@^4.17.21 — non-breaking.",
"confidence": 0.92,
"source_tool": "osv-scanner"
}