dependency-auditor

依赖审计技能

自动检查依赖项漏洞。

何时激活

• ✅ 修改 package.json
• ✅ 更改 requirements.txt
• ✅ 修改 Gemfile 或 pom.xml
• ✅ 用户提及依赖项或漏洞
• ✅ 部署前
• ✅ 更改 yarn.lock 或 package-lock.json

检查内容

依赖项漏洞

• 软件包中已知的 CVE
• 存在安全修复的过期依赖项
• 恶意软件包
• 许可证兼容性问题
• 已弃用的软件包

支持的包管理器

• Node.js：npm、yarn、pnpm
• Python：pip、pipenv、poetry
• Ruby：bundler
• Java：Maven、Gradle
• Go：go modules
• PHP：composer

警报示例

NPM 漏洞

# You run: npm install lodash

# I automatically audit:
🚨 HIGH: Prototype Pollution in lodash
📍 Package: [email protected]
📦 Vulnerable versions: < 4.17.21
🔧 Fix: npm update lodash
📖 CVE-2020-8203
   https://nvd.nist.gov/vuln/detail/CVE-2020-8203

Recommendation: Update to [email protected] or higher

Python 漏洞

# You modify requirements.txt: django==2.2.0

# I alert:
🚨 CRITICAL: Multiple vulnerabilities in Django 2.2.0
📍 Package: [email protected]
📦 Vulnerable versions: < 2.2.28
🔧 Fix: Update requirements.txt to Django==2.2.28
📖 CVEs: CVE-2021-33203, CVE-2021-33571

Affected: SQL injection, XSS vulnerabilities
Recommendation: Update immediately to [email protected]+

多个漏洞

# After npm install:
🚨 Dependency audit found 8 vulnerabilities:
  - 3 CRITICAL
  - 2 HIGH
  - 2 MEDIUM
  - 1 LOW

Critical issues:
  1. [email protected] - SSRF vulnerability
     Fix: npm install axios@latest

  2. [email protected] - Prototype pollution
     Fix: npm install ajv@^8.0.0

  3. [email protected] - Information disclosure
     Fix: npm install node-fetch@^2.6.7

Run 'npm audit fix' to automatically fix 6/8 issues

自动操作

依赖项变更时

1. Detect package manager (npm, pip, etc.)
2. Run security audit command
3. Parse vulnerability results
4. Categorize by severity
5. Suggest fixes
6. Flag breaking changes

审计命令

# Node.js
npm audit
npm audit --json  # Structured output

# Python
pip-audit
safety check

# Ruby
bundle audit

# Java (Maven)
mvn dependency-check:check

严重性分类

严重 🚨

• 远程代码执行
• SQL 注入
• 身份验证绕过
• 可被公开利用

高 ⚠️

• 跨站脚本攻击
• 拒绝服务
• 信息泄露
• 攻击面广

中 📋

• 影响有限的漏洞
• 需要特定条件
• 难以利用

低 💡

• 轻微的安全改进
• 违反最佳实践
• 风险极低

修复策略

自动更新

# Safe automatic fixes
npm audit fix

# May include breaking changes
npm audit fix --force

手动更新

# Check what will change
npm outdated

# Update specific package
npm update lodash

# Major version update
npm install lodash@latest

替代软件包

Vulnerable: [email protected] (deprecated)
Alternative: axios or node-fetch
Migration guide: [link]

与 CI/CD 集成

阻止部署

# .github/workflows/security.yml
- name: Dependency audit
  run: |
    npm audit --audit-level=high
    # Fails if HIGH or CRITICAL found

定期审计

# Weekly dependency check
on:
  schedule:
    - cron: '0 0 * * 0'
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - run: npm audit

沙盒兼容性

无需沙盒即可运行： ✅ 是 在沙盒中运行： ⚙️ 需要访问 npm/pip 注册表

沙盒配置：

{
  "network": {
    "allowedDomains": [
      "registry.npmjs.org",
      "pypi.org",
      "rubygems.org",
      "repo.maven.apache.org"
    ]
  }
}

许可证检查

我还会检查许可证兼容性：

⚠️ License issue: GPL-3.0 package in commercial project
📦 Package: [email protected]
📖 GPL-3.0 requires source code disclosure
🔧 Consider: Find MIT/Apache-2.0 alternative

最佳实践

1. 定期审计：每周或每次依赖项变更时运行
2. 频繁更新：保持依赖项为最新版本
3. 检查不兼容变更：重大更新前进行测试
4. 固定版本：在生产环境中使用确切版本
5. 审计锁定文件：提交并审计锁定文件

相关工具

• security-auditor skill：检测代码漏洞
• @architect sub-agent：依赖项策略
• /review command：部署前安全检查