chainlesschain 漏洞扫描技能
描述
扫描项目依赖的已知漏洞 (CVE)，执行可达性分析判断漏洞是否实际可利用，生成 SBOM，检查许可证兼容性。与 security-audit（扫描源码）互补。
使用方法
/vulnerability-scanner [选项]
选项
--reachability- 执行可达性分析（判断 CVE 是否实际影响应用）--sbom- 生成 Software Bill of Materials--format <type>- SBOM 格式: cyclonedx, spdx (默认: cyclonedx)--licenses- 许可证兼容性审计--fix- 自动生成修复 PR（版本升级）--scope <pkg>- 仅扫描特定包的依赖树
扫描范围
| 生态系统 | 文件 | 说明 |
|---|---|---|
| npm | package-lock.json | JavaScript/TypeScript 依赖 |
| pip | requirements.txt | Python 依赖 |
| maven | pom.xml | Java 依赖 |
| gradle | build.gradle.kts | Android/Kotlin 依赖 |
可达性分析
传统漏洞扫描产生大量误报。可达性分析追踪漏洞函数是否被应用实际调用:
CVE-2024-xxxx in lodash@4.17.20
├── Vulnerable function: _.template()
├── Used by: node_modules/ejs/lib/ejs.js
├── Called from: src/main/template/template-manager.js:45
└── Status: ⚠️ REACHABLE - Fix Required
CVE-2024-yyyy in axios@0.21.1
├── Vulnerable function: followRedirects()
├── Used by: node_modules/axios/lib/adapters/http.js
├── Not called from application code
└── Status: ℹ️ NOT REACHABLE - Low Priority
输出格式
漏洞报告
Vulnerability Scan Report
=========================
Scanned: package-lock.json
Dependencies: 1200 total (340 direct, 860 transitive)
CRITICAL (3 reachable):
❌ CVE-2024-xxxx lodash@4.17.20 → Upgrade to 4.17.21
❌ CVE-2024-yyyy express@4.18.0 → Upgrade to 4.19.2
❌ CVE-2024-zzzz jsonwebtoken@8.5.1 → Upgrade to 9.0.0
LOW (9 not reachable):
ℹ️ CVE-2024-aaaa semver@5.7.1 (not reachable)
...
Remediation:
npm install lodash@4.17.21 express@4.19.2 jsonwebtoken@9.0.0
示例
完整扫描:
/vulnerability-scanner
可达性分析:
/vulnerability-scanner --reachability
SBOM 生成:
/vulnerability-scanner --sbom --format cyclonedx
许可证审计:
/vulnerability-scanner --licenses