菜单
Scan the repository for vulnerable dependencies and known CVEs using Trivy, OSV-Scanner, and Grype via the Makefile. Use when the user asks to scan for vulnerabilities, check dependencies for CVEs, run OSV/Trivy/Grype, or run make scan-vulnerabilities.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Analyze sqlfluff-complexity JSON reports (hotspot digest and threshold tuning). Reuse --output when the file is no older than 5 minutes; otherwise run report. Scan paths and output path are always user-specified.
Guide users through configuring sqlfluff-complexity for a SQLFluff project by sampling reports, choosing a preset, explaining thresholds, per-directory strictness (nested .sqlfluff vs path_overrides), validating config, and recommending gradual CI rollout.
Inspect repository layout with tree and find, compare to AGENTS.md conventions, and fix misplaced or overly flat generated files. Use when auditing folder structure, after scaffolding or bulk file generation, when output looks flat, or when asked where code/tests/docs should live. Supports inspecting the repository root or a specified subdirectory.
Run linters and fix violations using Trunk when available; when Trunk is missing, run the equivalent tools from the dev environment (see .trunk/trunk.yaml and pyproject.toml) so agents still enforce Ruff, Pyright, Pylint, Bandit, and other enabled checks where possible.
Run unit tests and automatically fix code failures, regression bugs, or test mismatches. Use when tests are failing, after implementing new features, or to repair "broken" tests.
Build the project and automatically fix packaging or build errors (for example Hatch failures) and related breakage. Use when the project fails to build, shows "broken" states, or after making significant changes.
| name | security-scan |
| description | Scan the repository for vulnerable dependencies and known CVEs using Trivy, OSV-Scanner, and Grype via the Makefile. Use when the user asks to scan for vulnerabilities, check dependencies for CVEs, run OSV/Trivy/Grype, or run make scan-vulnerabilities. |
| compatibility | Requires `trivy`, `osv-scanner`, and `grype` on PATH (for example via Homebrew or `trunk install` if Trunk provides them in your environment). Run from the repository root after `make setup` or `uv sync` so lockfiles and manifests match what you ship. |
Run the template’s filesystem and dependency vulnerability checks in one place. The canonical entry point is Makefile target scan-vulnerabilities, which runs Trivy, OSV-Scanner, and Grype against the repo root.
uv lock, uv add, or edits to pyproject.toml)From the repository root:
make scan-vulnerabilities
Equivalent commands (for debugging or CI parity):
trivy fs .
osv-scanner scan -r .
grype .
If a command is missing, install the tool or run trunk install per AGENTS.md when Trunk manages these linters in your setup.
uv.lock, pyproject.toml) and CVE IDs.uv lock, version pins in pyproject.toml). Avoid silencing scanners in the template unless the user explicitly wants policy exceptions documented.make scan-vulnerabilities again until clean or remaining issues are accepted with rationale.