Vulnerability Scanning

作者 secondsky88378361314fMIT227 个星标收录于 2026年10月8日更新于 2026年10月8日仓库10天前更新

Automated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit. Use for CI/CD security gates, pre-deployment audits, compliance requirements, or encountering CVE detection, outdated packages, license compliance, SBOM generation errors.

仅含说明Security

AI 生成的概览

指导使用 Trivy、Snyk、npm audit 和 Bandit 对依赖、代码和容器进行自动化漏洞扫描。

功能: 该技能提供用于检测依赖、源代码和容器镜像中安全漏洞的指令与命令示例。内容涵盖 npm audit、Snyk、Safety、Trivy 镜像与文件系统扫描、面向 Python 的 Bandit，以及将这些扫描器作为 CI 安全门禁运行的 GitHub Actions 工作流。它还包含一段 Node.js 代码，用于执行扫描并在发现严重漏洞时以非零状态退出，并给出让构建失败和跟踪发现结果的最佳实践。
适用场景: 适用于搭建 CI/CD 安全门禁、执行部署前审计或满足合规要求的场景。也适合需要检测 CVE、发现过时依赖包、检查许可证合规、生成 SBOM 以及排查相关错误的场合。
运行要求: 需要安装并可用相关扫描工具，例如 Trivy、Snyk、npm audit、Safety、Bandit 或 OWASP Dependency-Check，运行示例代码还需要 Node.js。Snyk 在 CI 中需要 SNYK_TOKEN 密钥，并需要网络访问以获取漏洞数据。该技能仅包含指令，不附带脚本。

Vulnerability Scanning

Automate security vulnerability detection across code, dependencies, and containers.

Dependency Scanning

bash

# npm auditnpm audit --audit-level=high
# Snyksnyk test --severity-threshold=high
# Safety (Python)safety check --full-report

# npm auditnpm audit --audit-level=high
# Snyksnyk test --severity-threshold=high
# Safety (Python)safety check --full-report

Container Scanning (Trivy)

bash

# Scan container imagetrivy image myapp:latest --severity HIGH,CRITICAL
# Scan filesystemtrivy fs --scanners vuln,secret .

# Scan container imagetrivy image myapp:latest --severity HIGH,CRITICAL
# Scan filesystemtrivy fs --scanners vuln,secret .

GitHub Actions Integration

yaml

name: Security Scan
on: [push, pull_request]
jobs:  security:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner        uses: aquasecurity/[email protected]        with:          scan-type: 'fs'          severity: 'CRITICAL,HIGH'          exit-code: '1'
      - name: Run Snyk        uses: snyk/actions/node@v3        env:          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}        with:          args: --severity-threshold=high
      - name: npm audit        run: npm audit --audit-level=high

name: Security Scan
on: [push, pull_request]
jobs:  security:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner        uses: aquasecurity/[email protected]        with:          scan-type: 'fs'          severity: 'CRITICAL,HIGH'          exit-code: '1'
      - name: Run Snyk        uses: snyk/actions/node@v3        env:          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}        with:          args: --severity-threshold=high
      - name: npm audit        run: npm audit --audit-level=high

Code Analysis (Bandit for Python)

Node.js Scanner

javascript

const { execSync } = require('child_process');
function runScan(command) {  try {    return JSON.parse(execSync(command, { stdio: ['pipe', 'pipe', 'ignore'] }).toString());  } catch (err) {    // A tool may be missing, exit non-zero, or print non-JSON output (e.g.    // trivy progress text when not on a TTY). Treat that as "no parseable    // result" rather than crashing the scanner.    console.warn(`Scan command failed or returned non-JSON: ${command}`);    return null;  }}
function runSecurityScan() {  const results = {    npm: runScan('npm audit --json'),    trivy: runScan('trivy fs --quiet --format json .')  };
  if (!results.npm || !results.npm.metadata) {    console.warn('npm audit produced no metadata; skipping npm checks');  } else {    const critical = results.npm.metadata?.vulnerabilities?.critical || 0;    if (critical > 0) {      console.error(`Found ${critical} critical vulnerabilities`);      process.exit(1);    }  }}

const { execSync } = require('child_process');
function runScan(command) {  try {    return JSON.parse(execSync(command, { stdio: ['pipe', 'pipe', 'ignore'] }).toString());  } catch (err) {    // A tool may be missing, exit non-zero, or print non-JSON output (e.g.    // trivy progress text when not on a TTY). Treat that as "no parseable    // result" rather than crashing the scanner.    console.warn(`Scan command failed or returned non-JSON: ${command}`);    return null;  }}
function runSecurityScan() {  const results = {    npm: runScan('npm audit --json'),    trivy: runScan('trivy fs --quiet --format json .')  };
  if (!results.npm || !results.npm.metadata) {    console.warn('npm audit produced no metadata; skipping npm checks');  } else {    const critical = results.npm.metadata?.vulnerabilities?.critical || 0;    if (critical > 0) {      console.error(`Found ${critical} critical vulnerabilities`);      process.exit(1);    }  }}

Best Practices

Integrate scanning in CI/CD pipeline
Fail builds on high/critical findings
Scan dependencies and containers
Track vulnerabilities over time
Document accepted false positives

Tools

Trivy (containers, filesystem)
Snyk (dependencies, code)
npm audit / yarn audit
Bandit (Python)
OWASP Dependency-Check

来源与署名

来源：secondsky/claude-skills位于plugins/vulnerability-scanning/skills/vulnerability-scanning提交8837836

许可证： MIT

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Vulnerability Scanning

Vulnerability Scanning

Dependency Scanning

Container Scanning (Trivy)

GitHub Actions Integration

Code Analysis (Bandit for Python)

Node.js Scanner

Best Practices

Tools

来源与署名

更多来自 secondsky/claude-skills 的技能

Web Performance Optimization

Web Performance Audit

Threejs

Tailwind V4 Shadcn

Technical Specification

React Native Skills

更多Security技能

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt