360 Secure SkillHub
360 安全技能中心

CVE Audit Skill

该 Skill 使用 osv-ui 扫描项目依赖中的已知 CVE，汇总严重级别与修复版本，支持 JSON/HTML 报告和本地可视化仪表盘；在用户明确确认后才执行包升级并复扫验证。

toan203
toan203
热度 47.41
最近更新 2026-05-11 17:34:40
分类：安全依赖：代码执行 / 联网浏览搜索 / 读写文件 / 第三方 API应用场景：代码审查 / DevOps / 报告撰写 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add osv-ui
Metadata
name
osv-ui
description
Security auditing skill for scanning CVE vulnerabilities across npm, Python, Go, and Rust projects using osv-ui. Opens a visual browser dashboard for human review, then applies fixes with explicit confirmation.
version
1.0.0
author
toan203
homepage
https://github.com/toan203/osv-ui
tags
["security","cve","vulnerability","npm","python","go","rust","audit","dependabot"]
tools
["bash","computer"]

osv-ui — CVE Audit Skill

Use this skill whenever the user asks to:

  • Audit, scan, or check dependencies for vulnerabilities or CVEs
  • Find security issues in their npm, Python, Go, or Rust project
  • Get a visual security report or dashboard
  • Fix or upgrade vulnerable packages
  • Replace or complement npm audit, pip-audit, Snyk, or Dependabot

When to activate

Activate when the user mentions any of:

  • "audit", "scan", "CVE", "vulnerability", "security", "dependabot", "snyk"
  • "check my packages", "upgrade guide", "fix vulnerabilities"
  • "npm audit", "pip-audit", "cargo audit", "govulncheck"
  • "is my project secure?", "any known issues in my deps?"

Workflow

1 — Scan

# Single service
npx osv-ui --no-open --json ./osv-report.json

# Multiple services
npx osv-ui ./frontend ./api ./worker --no-open --json ./osv-report.json

# Auto-discover
npx osv-ui --discover --no-open --json ./osv-report.json

2 — Present summary

Parse osv-report.json and show:

📊 [project]: [N] packages · 🔴 Critical: N · 🟠 High: N · 🟡 Moderate: N · 🔵 Low: N · Risk: N/100
Top CVEs: [list top 5 by severity with fix version]

3 — Always offer the visual dashboard

"Want to review in a visual dashboard before I apply any fixes?"

npx osv-ui [same paths]
# Opens http://localhost:2003

4 — Show fix commands, get confirmation

Show what will change. NEVER apply without explicit user "yes".

npm install axios@0.30.3      # fixes 4 CVEs
npm install lodash@4.17.23    # fixes 3 CVEs

5 — Apply and verify

# Apply fixes
npm install [package@version]

# Re-scan to confirm
npx osv-ui --no-open --json ./osv-report-after.json

Notes

  • Never apply fixes silently — always confirm first
  • Prefer dashboard for 10+ CVEs
  • Alpha/beta/canary versions are never suggested as fix targets
  • Add --offline if OSV.dev is unreachable

Quick reference

npx osv-ui                          # scan current dir
npx osv-ui ./frontend ./api         # multi-service
npx osv-ui --discover               # auto-detect
npx osv-ui --json=report.json --no-open  # export JSON
npx osv-ui --html=report.html --no-open  # export HTML