Dependency vulnerability scan
Skill ligyDt/ai-ide-init-template/codex/.agents/skills/dependency-vulnerability-scan
面向 Codex、Cursor、CodeBuddy、TRAE 的中文 AI IDE 项目初始化模板，内置多角色协作、Skills、MCP、Hooks 与安全验证。
npx -y skills add ligyDt/ai-ide-init-template --skill dependency-vulnerability-scanAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
在新增、升级或审查依赖时检查安全漏洞、维护状态、许可证风险、供应链风险和替代方案。
SKILL.md
0.9 KB, as published. Nobody here has run it
依赖漏洞与许可证扫描
流程
- 识别包管理器、锁文件、直接依赖、间接依赖和运行环境。
- 优先使用项目已有 audit、SCA、许可证检查和 CI 命令。
- 对 High/Critical 漏洞、未知许可证、GPL/AGPL、废弃包和低维护依赖列为阻断或需人工确认。
- 给出替代依赖、版本固定、隔离使用或延后接入建议。
- 输出不会包含私有 registry token、许可证密钥或内部仓库凭据。
输出
- 依赖清单与风险级别
- 漏洞和许可证结论
- 推荐处理方案
- 需人工确认事项
停止条件
缺少目标、范围、运行环境或高风险授权时，先澄清或输出待确认事项，不擅自接入外部写入、支付、部署或生产资源。