360 Secure SkillHub
360 安全技能中心

x-osv

该 Skill 是 x-cmd 的 osv 模块，通过命令行查询 Google OSV 漏洞数据库：可按包名与版本或 commit 哈希查询漏洞、查看漏洞详情、列出支持的生态，并可借助 osv-scanner 扫描本地项目生成 SARIF 报告。依赖 x-cmd 运行时与 osv-scanner，基础用法无需 API Key。

edwinjhlee
edwinjhlee
热度 58.96
最近更新 2026-05-11 17:30:16
分类：安全依赖：代码执行 / 第三方 API / 读写文件应用场景：DevOps / API 集成 / 报告撰写 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add x-osv
Metadata
name
x-osv
description
CLI for Google OSV database. Query vulnerabilities for packages, scan local projects for vulnerable dependencies. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill). **Required Tool**: Install osv-scanner for project scanning (see https://github.com/google/osv-scanner).
license
Apache-2.0
compatibility
POSIX Shell
metadata
{"author":"Li Junhao","version":"1.0.1","category":"x-cmd-extension","tags":["x-cmd","security","vulnerability","osv","scanner"]}

x osv - Open Source Vulnerabilities

Query Google OSV database for package vulnerabilities and scan local projects.

Quick Start

# Query vulnerability for a package
x osv q -p jq -v 1.7.1

# Scan local project for vulnerabilities (requires osv-scanner)
x osv scanner .

Features

  • Vulnerability Query: Query OSV database for package vulnerabilities
  • Project Scanning: Scan local projects using osv-scanner
  • SARIF Reports: Generate SARIF security reports
  • Multi-ecosystem: Supports npm, pip, Maven, Go, Rust, etc.

Prerequisites

Tool Purpose Install
x-cmd Required module runtime brew install x-cmd
osv-scanner Project scanning https://github.com/google/osv-scanner

Commands

Command Description
x osv q <pkg> Query vulnerabilities for a package
x osv scanner <path> Scan project for vulnerabilities (requires osv-scanner)
x osv vuln <id> Get vulnerability details
x osv sarif Generate SARIF security reports
x osv eco List supported ecosystems

Examples

Query Vulnerabilities

# Query specific package version
x osv q -p jq -v 1.7.1

# Query by commit hash
x osv q -c 6879efc2c1596d11a6a6ad296f80063b558d5e0f

Scan Projects

# Scan current directory (requires osv-scanner installed)
x osv scanner .

# Scan specific lockfile
x osv scanner --lockfile requirements.txt
x osv scanner --lockfile package-lock.json

Generate SARIF Reports

# Scan npm project
x osv sarif npm ./my-project/

# Scan pip project with JSON output
x osv sarif pip ./project/ --json

Supported Ecosystems

View all supported ecosystems:

x osv eco

Includes: npm, PyPI, Maven, Go, Rust, NuGet, Packagist, etc.

API Key

No API key required for basic usage. Rate limits apply for unauthenticated requests.

Related