360 Secure SkillHub
360 安全技能中心

x-osv

这是x-cmd的安全类扩展工具，对接Google OSV漏洞数据库。核心功能：查询指定包、版本或提交记录的漏洞详情，扫描本地项目依赖漏洞，生成SARIF格式安全报告，支持npm、pip等多生态系统。典型场景：开发前排查依赖安全，定期扫描项目漏洞。需依赖x-cmd运行环境，项目扫描需额外安装osv-scanner，通过CLI命令交互输出结果。

edwinjhlee
edwinjhlee
热度 59.10
最近更新 2026-05-11 17:30:16
分类：安全依赖：代码执行 / 第三方 API应用场景：报告撰写 / DevOps

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add x-osv
Metadata
name
x-osv
description
CLI for Google OSV database. Query vulnerabilities for packages, scan local projects for vulnerable dependencies. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill). **Required Tool**: Install osv-scanner for project scanning (see https://github.com/google/osv-scanner).
license
Apache-2.0
compatibility
POSIX Shell
metadata
{"author":"Li Junhao","version":"1.0.1","category":"x-cmd-extension","tags":["x-cmd","security","vulnerability","osv","scanner"]}

x osv - Open Source Vulnerabilities

Query Google OSV database for package vulnerabilities and scan local projects.

Quick Start

# Query vulnerability for a package
x osv q -p jq -v 1.7.1

# Scan local project for vulnerabilities (requires osv-scanner)
x osv scanner .

Features

  • Vulnerability Query: Query OSV database for package vulnerabilities
  • Project Scanning: Scan local projects using osv-scanner
  • SARIF Reports: Generate SARIF security reports
  • Multi-ecosystem: Supports npm, pip, Maven, Go, Rust, etc.

Prerequisites

Tool Purpose Install
x-cmd Required module runtime brew install x-cmd
osv-scanner Project scanning https://github.com/google/osv-scanner

Commands

Command Description
x osv q <pkg> Query vulnerabilities for a package
x osv scanner <path> Scan project for vulnerabilities (requires osv-scanner)
x osv vuln <id> Get vulnerability details
x osv sarif Generate SARIF security reports
x osv eco List supported ecosystems

Examples

Query Vulnerabilities

# Query specific package version
x osv q -p jq -v 1.7.1

# Query by commit hash
x osv q -c 6879efc2c1596d11a6a6ad296f80063b558d5e0f

Scan Projects

# Scan current directory (requires osv-scanner installed)
x osv scanner .

# Scan specific lockfile
x osv scanner --lockfile requirements.txt
x osv scanner --lockfile package-lock.json

Generate SARIF Reports

# Scan npm project
x osv sarif npm ./my-project/

# Scan pip project with JSON output
x osv sarif pip ./project/ --json

Supported Ecosystems

View all supported ecosystems:

x osv eco

Includes: npm, PyPI, Maven, Go, Rust, NuGet, Packagist, etc.

API Key

No API key required for basic usage. Rate limits apply for unauthenticated requests.

Related