performing-sca-dependency-scanning-with-snyk

This skill covers implementing Software Composition Analysis (SCA) using Snyk to detect vulnerable open-source dependencies in CI/CD pipelines. It addresses scanning package manifests and lockfiles, automated fix pull request generation, license compliance checking, continuous monitoring of deployed applications, and integration with GitHub, GitLab, and Jenkins pipelines.

跳到安装

仓库: xalgord/xalgorix
最近来源活动: 2026年6月6日 16:41
检测到的 SKILL.md 语言: 英语
星标: 813
分支: 146

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/xalgord/xalgorix --skill performing-sca-dependency-scanning-with-snyk

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

查看这个仓库的全部 Skills

Performing SCA Dependency Scanning with Snyk

When to Use

When applications use open-source packages that may contain known vulnerabilities

When compliance requires tracking and remediating vulnerable dependencies (PCI DSS, SOC 2)

When needing automated fix PRs for vulnerable dependencies in CI/CD

When license compliance requires visibility into open-source license obligations

When continuous monitoring is needed for newly disclosed vulnerabilities in deployed dependencies

Do not use for scanning proprietary application code for logic vulnerabilities (use SAST), for runtime vulnerability detection (use DAST), or for container OS package scanning alone (use Trivy for a free alternative).

Coverage Gaps & Validation

Transitive deps silently skipped: Snyk only resolves the full tree when a lockfile is present. snyk test against a bare requirements.txt or package.json with no package-lock.json/poetry.lock scans direct deps only. Generate the lockfile first and confirm the "Dependencies" count includes transitives, not just 47 direct.

Vendored / monorepo deps missed: committed vendor/, sub-projects, and non-default manifests aren't found unless you pass --all-projects (or --file=). Verify each manifest appears in the test output.

--severity-threshold=high hides exploitable lows: the threshold suppresses medium/low from the report entirely, not just the gate. Scan at --severity-threshold=low for inventory, gate separately.

Gate not actually failing: snyk test exits non-zero on findings, but snyk monitor always exits 0. Use --fail-on=all (not just --fail-on=upgradable, which passes when no upgrade exists) and confirm the CI step's exit code.

OS vs app libs: snyk test covers app dependencies; OS packages in an image need snyk container test. Run both.

Reachability ≠ presence: "we don't call that function" is not proof — Snyk's reachability is best-effort and misses dynamic dispatch. Validate completeness by adding a knowingly vulnerable pin (e.g. lodash@4.17.4) and confirming it surfaces at the expected severity and trips --fail-on=all.