사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/owasp/secure-agent-playbook --skill sca-audit시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
Software Composition Analysis Audit
Scan dependencies for known CVEs by following the full procedure in plays/sca-audit.md.
Steps
- Identify Dependency Manifests — Scan for all dependency files and lockfiles across ecosystems (Node.js, Python, Go, Java, Ruby, Rust, .NET, PHP). Prefer lockfiles for exact resolved versions.
- Run Vulnerability Scan — Use available tools in preference order:
osv-scanner --lockfile=<path> --format=json(recommended, multi-ecosystem)npm audit --json(Node.js)pip-audit -r requirements.txt --format=json(Python)govulncheck ./...(Go)trivy fs --format json --scanners vuln <path>(multi-ecosystem)- If no scanner is installed, stop and ask the user to install one (e.g.,
brew install osv-scanner). Manual analysis is not viable — even small projects have 50+ dependencies. For individual package triage, point the user to OSV.dev.
- Analyze Results — For each vulnerability: determine reachability (is the vulnerable code path used?), check exploitability context (deployment matters), and identify fix availability (patch vs major version bump).
- Dependency Health — Beyond CVEs, flag unmaintained packages (2+ years inactive), typosquatting risks, license concerns, and version pinning issues.
Output
Scan summary (ecosystems, dependency count, scanner used), findings sorted by severity using templates/finding.md, condensed table for medium/low, dependency health flags, and exact remediation commands.
OWASP References
- A06:2021: Vulnerable and Outdated Components
- OWASP Dependency-Check
- OWASP SCVS
