使用方法
- 复制安装命令，在自己的智能体环境安装前先检查源码包。
- 从原始文档核对所需工具、凭据和支持的宿主。
- 说明输入材料与期望交付物，并对照来源检查输出。
npx skills add https://github.com/owasp/secure-agent-playbook --skill sca-audit开始前需了解
- 安装不包含模型订阅、API 额度或访问文件的权限。
- 仓库星数和安装量反映活跃情况，不等于独立质量或安全测试。
仓库原始内容
按源仓库内容呈现，保留标题、案例、代码、表格、链接以及原文引用的演示图片。
Software Composition Analysis Audit
Scan dependencies for known CVEs by following the full procedure in plays/sca-audit.md.
Steps
- Identify Dependency Manifests — Scan for all dependency files and lockfiles across ecosystems (Node.js, Python, Go, Java, Ruby, Rust, .NET, PHP). Prefer lockfiles for exact resolved versions.
- Run Vulnerability Scan — Use available tools in preference order:
osv-scanner --lockfile=<path> --format=json(recommended, multi-ecosystem)npm audit --json(Node.js)pip-audit -r requirements.txt --format=json(Python)govulncheck ./...(Go)trivy fs --format json --scanners vuln <path>(multi-ecosystem)- If no scanner is installed, stop and ask the user to install one (e.g.,
brew install osv-scanner). Manual analysis is not viable — even small projects have 50+ dependencies. For individual package triage, point the user to OSV.dev.
- Analyze Results — For each vulnerability: determine reachability (is the vulnerable code path used?), check exploitability context (deployment matters), and identify fix availability (patch vs major version bump).
- Dependency Health — Beyond CVEs, flag unmaintained packages (2+ years inactive), typosquatting risks, license concerns, and version pinning issues.
Output
Scan summary (ecosystems, dependency count, scanner used), findings sorted by severity using templates/finding.md, condensed table for medium/low, dependency health flags, and exact remediation commands.
OWASP References
- A06:2021: Vulnerable and Outdated Components
- OWASP Dependency-Check
- OWASP SCVS
