菜单
Multi-language dependency security scan - Use Safety CLI and OSV-Scanner to quickly detect dependency vulnerabilities in Python/JS/Java projects
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
AI Agent code quality check - Use Ruff to check code standards for LangChain, AutoGen, and other AI Agent projects
Database migration management - Use Flyway and Atlas for version-controlled database schema migrations
Dockerfile best practices check - Use hadolint to validate Dockerfile security, performance, and compliance
Format JavaScript/TypeScript code with Prettier
Format Python code with Black
Auto-generate project changelog
| name | vuln-scan |
| description | Multi-language dependency security scan - Use Safety CLI and OSV-Scanner to quickly detect dependency vulnerabilities in Python/JS/Java projects |
Provides two lightweight vulnerability scanning tools:
| Tool | Installation (All Platforms) |
|---|---|
| Safety CLI | pip install safety |
| OSV-Scanner | Download |
Safety CLI Scan:
# Windows
.\.agent\skills\vuln-scan\scripts\safety-scan.ps1
# Linux/Mac
./.agent/skills/vuln-scan/scripts/safety-scan.sh
OSV-Scanner Scan:
# Windows
.\.agent\skills\vuln-scan\scripts\osv-scan.ps1
# Linux/Mac
./.agent/skills/vuln-scan/scripts/osv-scan.sh
CI/CD Mode:
.\.agent\skills\vuln-scan\scripts\safety-scan.ps1 -CI
# Sets exit code, breaks pipeline on failure
🔍 Vulnerability Scan - Safety CLI
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📦 Scanning: requirements.txt (23 dependencies)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
╭────────────────────────────────────────╮
│ ❌ VULNERABILITY FOUND │
├────────────────────────────────────────┤
│ Package: urllib3 │
│ Installed: 1.26.5 │
│ Affected: <1.26.18 │
│ ID: 51499 │
│ │
│ OWASP Top 10: A05:2021 - Security │
│ Misconfiguration │
│ │
│ Description: │
│ urllib3's request body can leak from │
│ URLError exceptions │
│ │
│ Fix: Upgrade to urllib3>=1.26.18 │
╰────────────────────────────────────────╯
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Scan Results:
🔴 Critical: 0
🟠 High: 1
🟡 Medium: 2
🟢 Low: 0
💡 Fix Suggestion:
pip install --upgrade urllib3>=1.26.18
.safety-policy.yml)# Security policy config
security:
# Ignore specific vulnerability IDs
ignore-vulnerabilities:
51499:
reason: "False positive - not using affected functionality"
expires: "2026-12-31"
# Ignore specific packages
ignore-packages:
- package: test-utils
reason: "Dev dependency only"
# Set CVSS threshold
continue-on-vulnerability-error: false
fail-security-check-threshold: 7.0
# Monitoring config
alert:
# Optional: Integrate Slack/Email alerts
on-vulnerability: slack
webhook: ${SAFETY_WEBHOOK_URL}
[[IgnoredVulns]]
id = "GHSA-xxxx-yyyy-zzzz"
reason = "Not applicable to our use case"
[[PackageOverrides]]
name = "example"
version = "1.0.0"
ecosystem = "npm"
ignore = true
Safety CLI Auto-upgrade:
# Generate fix commands
safety check --json | safety generate fixes
# Or apply fixes directly (use with caution)
safety check --apply-fixes
Manual Fix Examples:
# Python
pip install --upgrade package-name>=safe-version
# JavaScript
npm update package-name@safe-version
# Java (Maven)
# Modify version in pom.xml
name: Security Scan
on: [push, pull_request]
jobs:
safety-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: Install Safety
run: pip install safety
- name: Run Safety Check
run: safety check --json
env:
SAFETY_API_KEY: ${{ secrets.SAFETY_API_KEY }}
osv-scan:
image: golang:latest
script:
- go install github.com/google/osv-scanner/cmd/osv-scanner@latest
- osv-scanner --lockfile=package-lock.json
Q: Does Safety CLI require an API Key?
A: Free version has limits, recommend applying for free API Key: safety.com
Q: OSV-Scanner vs Safety CLI?
A:
Q: How to use in offline environments?
A: Safety CLI can download offline database; OSV-Scanner supports local caching
Q: Too many false positives?
A: Use config files to suppress known false positives, keep reason notes