dependency-scan

依赖项扫描

分析软件包依赖项，查找已知漏洞。

快速入门

/dependency-scan                  # Scan all detected package managers
/dependency-scan --npm            # Node.js packages only
/dependency-scan --pip            # Python packages only
/dependency-scan --fix            # Auto-fix where possible

此技能的功能

1. 识别项目中的软件包管理器
2. 解析依赖项清单（package.json、requirements.txt 等）
3. 查询漏洞数据库，查找已知 CVE
4. 报告严重程度和修复选项
5. 可选择自动修复，更新到已修补的版本

支持的软件包管理器

生态系统	文件	使用的工具
Node.js	package.json、package-lock.json	npm audit
Python	requirements.txt、Pipfile、pyproject.toml	pip-audit、safety
Ruby	Gemfile、Gemfile.lock	bundler-audit
Java	pom.xml、build.gradle	dependency-check
Go	go.mod、go.sum	govulncheck
Rust	Cargo.toml、Cargo.lock	cargo-audit
PHP	composer.json、composer.lock	composer audit
.NET	*.csproj、packages.config	dotnet list --vulnerable

扫描模式

完整扫描

/dependency-scan

扫描所有检测到的软件包管理器，并报告所有严重程度的漏洞。

特定生态系统

/dependency-scan --npm
/dependency-scan --pip
/dependency-scan --go

严重程度筛选

/dependency-scan --severity critical,high
/dependency-scan --severity medium

自动修复模式

/dependency-scan --fix
/dependency-scan --fix --dry-run    # Preview changes

尝试将存在漏洞的软件包更新到已修补的版本。

输出格式

摘要视图

DEPENDENCY SCAN RESULTS
=======================

Scanned: package.json, requirements.txt
Packages analyzed: 127 (78 npm, 49 pip)

VULNERABILITIES BY SEVERITY
  Critical: 2
  High: 4
  Medium: 8
  Low: 12

TOP ISSUES

[!] CRITICAL: lodash < 4.17.21
    CVE-2021-23337: Command Injection
    Affected: [email protected]
    Fix: npm update lodash

[!] CRITICAL: urllib3 < 2.0.6
    CVE-2023-43804: Cookie Leak
    Affected: [email protected]
    Fix: pip install urllib3>=2.0.6

[H] HIGH: express < 4.19.2
    CVE-2024-29041: Open Redirect
    Affected: [email protected]
    Fix: npm update express

详细视图

/dependency-scan --details

DETAILED VULNERABILITY REPORT
=============================

CVE-2021-23337
--------------
Package: lodash
Installed: 4.17.19
Patched: 4.17.21
Severity: CRITICAL (CVSS 9.8)

Description:
  Command Injection in lodash template function allows
  arbitrary command execution via crafted template strings.

Attack Vector: Remote, no auth required
Exploitability: Public exploit available

References:
  - https://nvd.nist.gov/vuln/detail/CVE-2021-23337
  - https://github.com/lodash/lodash/issues/5085

Remediation:
  npm update lodash
  # or
  npm install [email protected]

漏洞来源

查询的数据库

数据库	覆盖范围
NVD（国家漏洞数据库）	所有 CVE
GitHub Advisory Database	GitHub 报告的漏洞
OSV（开源漏洞）	多生态系统
npm Security Advisories	Node.js 特定漏洞
PyPI Advisory Database	Python 特定漏洞
RustSec Advisory Database	Rust 特定漏洞

CVSS 评分

分数	严重程度
9.0-10.0	严重
7.0-8.9	高
4.0-6.9	中
0.1-3.9	低

使用的命令

Node.js（npm）

npm audit --json
npm audit fix           # Auto-fix
npm audit fix --force   # Breaking changes OK

Python（pip-audit）

pip-audit
pip-audit --fix
pip-audit -r requirements.txt

Python（safety）

safety check
safety check -r requirements.txt

Ruby（bundler-audit）

bundle-audit check
bundle-audit update     # Update advisory DB

Go（govulncheck）

govulncheck ./...

Rust（cargo-audit）

cargo audit
cargo audit fix         # Auto-fix

自动修复行为

安全修复

在语义化版本兼容范围内更新：

• 补丁版本（1.2.3 → 1.2.4）
• 锁定到主版本时可更新次要版本（^1.2.3 → ^1.3.0）

可能造成不兼容的修复

可能引入不兼容变更：

• 主版本更新
• 需要使用 --force 标志

修复报告

AUTO-FIX REPORT
===============

Fixed: 8 vulnerabilities
  lodash: 4.17.19 → 4.17.21
  axios: 0.21.0 → 0.21.1
  minimist: 1.2.5 → 1.2.6

Unable to fix: 2 vulnerabilities
  react-scripts: No patch available (major version required)
  webpack-dev-server: Conflicts with other dependencies

Review package.json changes before committing.

配置

忽略已知问题

创建 .dependency-scan-ignore：

# Ignore specific CVEs (document reason!)
ignore:
  - id: CVE-2021-23337
    reason: "Not exploitable in our usage, lodash template not used"
    expires: 2024-12-31

  - id: GHSA-xxx-xxx
    reason: "Development dependency only"

# Ignore packages
packages:
  - name: lodash
    versions: ["< 4.17.0"]  # Only old versions

严重程度阈值

# .dependency-scan.yaml
thresholds:
  fail_on: critical         # Fail CI on critical
  warn_on: high            # Warn on high
  ignore_below: low        # Don't report low

fix:
  auto_fix: true
  allow_major: false       # No major version bumps

CI/CD 集成

GitHub Actions

- name: Dependency Scan
  run: |
    /dependency-scan --severity critical,high --fail-on-findings

- name: Auto-fix and PR
  if: failure()
  run: |
    /dependency-scan --fix
    git add .
    gh pr create --title "Security: Update vulnerable dependencies"

Pre-Commit

#!/bin/sh
# Run on package.json changes
if git diff --cached --name-only | grep -q "package.json\|requirements.txt"; then
  /dependency-scan --severity critical,high
fi

依赖项健康状况

除 CVE 之外

/dependency-scan --health

其他检查：

• 过时的软件包：落后多个主版本
• 已弃用的软件包：不再维护
• 许可证问题：许可证不兼容
• 维护状况：上次更新、未解决的问题

健康状况报告

DEPENDENCY HEALTH
=================

Outdated (major behind): 5
  react: 17.0.2 → 18.2.0
  typescript: 4.9.5 → 5.3.3

Deprecated: 1
  request: Use got, axios, or node-fetch

Unmaintained (>2 years): 2
  moment: Consider dayjs or date-fns

License Issues: 0

相关技能

• /security-scan - 全面安全分析
• /secrets-scan - 凭据检测
• /config-scan - 配置安全