absolute-audit

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Start your first response with the 🔒 emoji.

首次回复请以🔒 emoji开头。

Absolute Audit

全面安全审计（Absolute Audit）

Find and triage security problems across the repo — vulnerable dependencies (CVEs) and risky code patterns — then fix the ones worth fixing, safely. Output is a severity-ranked findings table with a remediation per item, not a raw scanner dump.

Runs the shared engine in references/health-engine.md
— read it for the DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT loop and the safety contract. This file covers only what's specific to security auditing.

Authorized defensive use. This command audits the user's own repository to find and fix weaknesses. It is for hardening, not for attacking systems or evading detection.

检测并分类仓库中存在的安全问题——包括存在漏洞的依赖项（CVE）和危险代码模式——然后安全修复值得处理的问题。输出内容为按严重性排序的问题列表，每个问题附带修复方案，而非原始扫描器输出的杂乱数据。

运行**

references/health-engine.md

**中定义的共享引擎——可查看该文件了解DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT的流程以及安全协议。本文档仅涵盖安全审计相关的特定内容。

授权防御性使用。该命令仅用于审计用户自有仓库，查找并修复安全弱点，目的是增强系统安全性，而非攻击系统或规避检测。

When to use

使用场景

"Run a security audit", "are we vulnerable?", "check our deps for CVEs".
After a CVE disclosure affecting something you use.
Periodic hygiene on
```
main
```
.

Distinct from the built-in /security-review
(reviews the pending diff on your branch) —

audit

scans the whole committed repo, deps included. They complement.

当你输入"Run a security audit"、"are we vulnerable?"、"check our deps for CVEs"等指令时
当你使用的组件被披露存在CVE漏洞时
定期对
```
main
```
分支进行安全维护时

与内置的**

/security-review

（仅审核分支上的待合并差异）不同，
audit
会扫描整个已提交的仓库**，包括依赖项。两者功能互补。

What it scans

扫描范围

1. Dependency vulnerabilities (CVEs) — primary:

Ecosystem	Scanner
npm / pnpm / yarn	`npm audit --json` / `pnpm audit --json` / `yarn npm audit --json`
Python	`pip-audit` (preferred) or `safety check`
Go	`govulncheck ./...`
Cross-language	`osv-scanner` against the lockfile if available

2. Code-level patterns — read-only grep/static pass for high-signal issues only: hardcoded secrets/keys/tokens,

eval

/dynamic exec on input, SQL built by string concatenation, missing authz checks on sensitive routes, disabled TLS verification, unsafe deserialization, overly-broad CORS. Prefer the project's existing SAST/linter security rules (

eslint-plugin-security

bandit

gosec

) if configured.

Report suspected leaked secrets but never print the secret value — reference

path:line

and the kind.

1. 依赖项漏洞（CVE）——核心扫描内容：

生态系统	扫描工具
npm / pnpm / yarn	`npm audit --json` / `pnpm audit --json` / `yarn npm audit --json`
Python	`pip-audit` （优先推荐）或 `safety check`
Go	`govulncheck ./...`
跨语言	若存在锁文件，则使用 `osv-scanner` 扫描

2. 代码层面风险模式——仅通过只读grep/静态分析检测高风险问题：硬编码密钥/令牌、对输入执行

eval

/动态执行、字符串拼接生成SQL、敏感路由缺少权限控制（authz）、禁用TLS验证、不安全反序列化、过于宽松的CORS配置。若项目已配置SAST/代码检查工具的安全规则（如

eslint-plugin-security

、

bandit

、

gosec

），则优先使用这些规则。

报告疑似泄露的密钥，但绝对不可打印密钥内容——只需标注路径:行号以及密钥类型。

Risk ranking (TRIAGE)

风险优先级划分（TRIAGE）

Rank by severity × exploitability × reachability, not raw CVSS:

Severity	Default
Critical / High, reachable, fix available	fix now (wave 1)
Moderate, reachable	fix this pass
Low / not reachable from app code	report, usually defer
Transitive-only, no direct upgrade path	flag, note the blocking parent

Mark each: is it reachable from the app's actual code paths? A CVE in an unused transitive branch is lower priority than a Moderate one on a hot path. State the fixed version or the mitigation for each.

按照严重性×可利用性×可触及性进行优先级划分，而非仅依据原始CVSS评分：

严重性	默认处理策略
严重/高危，可触及，已有修复方案	立即修复（第一阶段）
中危，可触及	当前批次修复
低危/无法从应用代码触及	仅报告，通常延后处理
仅间接依赖，无直接升级路径	标记问题，注明阻塞的父依赖

对每个问题标记：是否可从应用实际代码路径触及？未使用的间接依赖分支中的CVE，优先级低于核心路径上的中危漏洞。需注明每个问题的修复版本或缓解措施。

Fix & verify

修复与验证

Dep CVEs → resolve via the smallest version move that clears it (delegate the actual bump mechanics to the
```
upgrade
```
flow's per-ecosystem steps). Prefer patched minors; escalate to a major only when that's the only fix, and gate it.
Code issues → apply the concrete fix (parameterize the query, move the secret to env
- flag the leaked one for rotation, add the authz check). Each fix is its own small wave.
After each wave, re-run the scanner: the finding must actually disappear, and tests/build stay green. Never resolve by suppressing/allowlisting the alert.
Leaked live secrets: flag for rotation — removing from code doesn't undo exposure.

依赖项CVE → 通过最小版本升级修复漏洞（实际版本升级操作交由
```
upgrade
```
流程中对应生态系统的步骤处理）。优先选择补丁版本的小版本升级；仅当无其他修复方案时才进行大版本升级，并需严格管控。
代码问题 → 应用具体修复方案（如参数化查询、将密钥迁移至环境变量并标记泄露密钥需轮换、添加权限控制检查）。每个修复作为独立的小批次进行。
每批次修复完成后，重新运行扫描器：问题必须实际消失，且测试/构建保持正常。禁止通过抑制/加入白名单的方式处理告警。
若泄露的是有效密钥：标记为需轮换——从代码中删除并不等同于消除泄露风险。

Gotchas

注意事项

Audit fatigue → blanket ignore. Triage by reachability instead of muting the scanner.
Fixing a CVE by suppressing it. An allowlisted advisory is still a vulnerability.
Printing the secret. Reference location + type only; never echo the value.
Deleting a secret from code ≠ safe. It's in git history and was exposed — rotate it.
Stopping at deps. Many real issues are in code, not the dependency tree — run both passes.

审计疲劳导致全盘忽略。应通过可触及性划分优先级，而非禁用扫描器。
通过抑制告警修复CVE。加入白名单的漏洞仍然是安全隐患。
打印密钥内容。仅标注位置和类型，绝对不可输出密钥值。
从代码中删除密钥并不安全。密钥已存在于git历史中且已泄露——必须进行轮换。
仅扫描依赖项。许多实际安全问题存在于代码中，而非依赖树——需同时运行两种扫描。

Companion commands

配套命令

/absolute upgrade
— does the actual version moves for vulnerable deps.
/security-review
(built-in) — pair with this to also cover your pending diff.
/absolute work
— if remediation is a real refactor (e.g. replacing an auth flow), hand off.

/absolute upgrade
— 负责执行存在漏洞的依赖项的版本升级操作。
/security-review
（内置命令）——与本命令配合使用，可同时覆盖待合并的代码差异。
/absolute work
— 若修复需要进行重构（如替换认证流程），可移交至该命令处理。