AgentSkillsCN

security-vulnerability-audit

使用 Trunk（Trivy 和 OSV-scanner）开展安全漏洞审计工作。当您需要检查项目漏洞、排查硬编码密钥，或修复安全缺陷时，可使用此技能。

SKILL.md
--- frontmatter
name: security-vulnerability-audit
description: Workflow for auditing security vulnerabilities using Trunk (Trivy and OSV-scanner). Use when checking for project vulnerabilities, hard-coded secrets, or repairing security flaws.

Security Vulnerability Audit

This skill provides a structured process for identifying and reporting security vulnerabilities in the codebase using Trunk's integrated security tools.

Audit Workflow

  1. •

    Run Security Scan: Execute the project's security linting script.

    bash
    pnpm run lint:security

    Note: This command runs trunk check --all --scope security, which triggers both Trivy and OSV-scanner.

  2. •

    Analyze Findings: Review the output from Trunk. Pay close attention to:

    • •Critical/High vulnerabilities in dependencies (reported by osv-scanner).
    • •Hard-coded secrets or configuration issues (reported by trivy).
  3. •

    Compile Report: Use the findings to create a summary of the security posture.

Reporting Format

For each significant finding, provide:

  • •Severity: [Critical/High/Medium/Low]
  • •Tool: [Trivy/OSV-Scanner]
  • •Description: [Brief description of the vulnerability]
  • •Impact: [What happens if exploited?]
  • •Recommendation: [How to fix it, e.g., "Update package X to version Y"]

Resources