# Vulnerability Scanner

> 漏洞扫描技能 - 依赖CVE扫描、可达性分析、SBOM生成、许可证审计

- Skill: `chainlesschain/vulnerability-scanner` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add chainlesschain/vulnerability-scanner`
- Raw SKILL.md: https://api.skillmd.com/api/skills/chainlesschain/vulnerability-scanner/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: chainlesschain (https://skillmd.com/u/chainlesschain)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/chainlesschain/vulnerability-scanner

---


# 漏洞扫描技能

## 描述

扫描项目依赖的已知漏洞 (CVE)，执行可达性分析判断漏洞是否实际可利用，生成 SBOM，检查许可证兼容性。与 security-audit（扫描源码）互补。

## 使用方法

```
/vulnerability-scanner [选项]
```

## 选项

- `--reachability` - 执行可达性分析（判断 CVE 是否实际影响应用）
- `--sbom` - 生成 Software Bill of Materials
- `--format <type>` - SBOM 格式: cyclonedx, spdx (默认: cyclonedx)
- `--licenses` - 许可证兼容性审计
- `--fix` - 自动生成修复 PR（版本升级）
- `--scope <pkg>` - 仅扫描特定包的依赖树

## 扫描范围

| 生态系统 | 文件              | 说明                       |
| -------- | ----------------- | -------------------------- |
| npm      | package-lock.json | JavaScript/TypeScript 依赖 |
| pip      | requirements.txt  | Python 依赖                |
| maven    | pom.xml           | Java 依赖                  |
| gradle   | build.gradle.kts  | Android/Kotlin 依赖        |

## 可达性分析

传统漏洞扫描产生大量误报。可达性分析追踪漏洞函数是否被应用实际调用:

```
CVE-2024-xxxx in lodash@4.17.20
├── Vulnerable function: _.template()
├── Used by: node_modules/ejs/lib/ejs.js
├── Called from: src/main/template/template-manager.js:45
└── Status: ⚠️ REACHABLE - Fix Required

CVE-2024-yyyy in axios@0.21.1
├── Vulnerable function: followRedirects()
├── Used by: node_modules/axios/lib/adapters/http.js
├── Not called from application code
└── Status: ℹ️ NOT REACHABLE - Low Priority
```

## 输出格式

### 漏洞报告

```
Vulnerability Scan Report
=========================
Scanned: package-lock.json
Dependencies: 1200 total (340 direct, 860 transitive)

CRITICAL (3 reachable):
  ❌ CVE-2024-xxxx lodash@4.17.20 → Upgrade to 4.17.21
  ❌ CVE-2024-yyyy express@4.18.0 → Upgrade to 4.19.2
  ❌ CVE-2024-zzzz jsonwebtoken@8.5.1 → Upgrade to 9.0.0

LOW (9 not reachable):
  ℹ️ CVE-2024-aaaa semver@5.7.1 (not reachable)
  ...

Remediation:
  npm install lodash@4.17.21 express@4.19.2 jsonwebtoken@9.0.0
```

## 示例

完整扫描:

```
/vulnerability-scanner
```

可达性分析:

```
/vulnerability-scanner --reachability
```

SBOM 生成:

```
/vulnerability-scanner --sbom --format cyclonedx
```

许可证审计:

```
/vulnerability-scanner --licenses
```