Back to Details

security-scanner

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Security Scanner

安全扫描器

Proactive pre-deployment security assessment. SAST pattern matching, secrets detection, dependency scanning, OWASP/CWE mapping, and compliance heuristics.
Scope: Pre-deployment security audit only. NOT for code review (use 
review
), authorized live offensive testing (use 
pentest
with signed ROE), penetration testing without static audit context, runtime security monitoring, or supply chain deep analysis.
主动式部署前安全评估。包含SAST模式匹配、密钥检测、依赖项扫描、OWASP/CWE映射以及合规性启发式分析。
适用范围： 仅用于部署前安全审核。不适用于代码评审（请使用
review
）、未经授权的实时攻击性测试（需签署ROE后使用
pentest
）、无静态审核上下文的渗透测试、运行时安全监控或供应链深度分析。

Canonical Vocabulary

标准术语表

TermDefinition
findingA discrete security issue with severity, CWE mapping, confidence, and remediation
severityCRITICAL / HIGH / MEDIUM / LOW / INFO classification per CVSS-aligned heuristics
confidenceScore 0.0-1.0 per finding; >=0.7 report, 0.3-0.7 flag as potential, <0.3 discard
CWECommon Weakness Enumeration identifier mapping the finding to a known weakness class
OWASPOpen Web Application Security Project Top 10 category mapping
SASTStatic Application Security Testing — pattern-based source code analysis
secretHardcoded credential, API key, token, or private key detected in source
lockfileDependency manifest with pinned versions (package-lock.json, uv.lock, etc.)
complianceLightweight heuristic scoring against SOC2/GDPR/HIPAA controls
triageRisk-stratify files by security relevance before deep scanning
remediationSpecific fix guidance with code examples when applicable
SARIFStatic Analysis Results Interchange Format for CI integration
false positiveDetection matching a pattern but not an actual vulnerability
术语定义
finding一个具有严重性、CWE映射、置信度和修复建议的独立安全问题
severity基于CVSS对齐启发式规则的CRITICAL / HIGH / MEDIUM / LOW / INFO分类
confidence每个问题的评分（0.0-1.0）；≥0.7则报告，0.3-0.7标记为潜在问题，<0.3则丢弃
CWE通用弱点枚举标识符，将问题映射到已知的弱点类别
OWASPOpen Web Application Security Project Top 10类别映射
SASTStatic Application Security Testing — 基于模式的源代码分析
secret在源代码中检测到的硬编码凭证、API密钥、令牌或私钥
lockfile包含固定版本的依赖清单（package-lock.json、uv.lock等）
compliance针对SOC2/GDPR/HIPAA控制项的轻量级启发式评分
triage在深度扫描前按安全相关性对文件进行风险分层
remediation特定的修复指导，适用时提供代码示例
SARIF用于CI集成的静态分析结果交换格式
false positive匹配模式但并非实际漏洞的检测结果

Dispatch

调度指令

$ARGUMENTSModeAction
Empty—Show dispatch menu and example invocations; do not start a scan
scan [path]
scan
Full security scan of path (default: cwd)
check <file/dir>
check
Targeted security check on specific files
deps [path]
deps
Dependency lockfile analysis
secrets [path]
secrets
Secrets-only regex scan
compliance <standard>
compliance
SOC2/GDPR/HIPAA heuristic checklist
report
report
Dashboard visualization of findings
Unrecognized input—Ask for clarification
$ARGUMENTS模式操作
空参数—显示调度菜单和调用示例；请勿启动扫描
scan [path]
scan
对指定路径进行完整安全扫描（默认：当前工作目录）
check <file/dir>
check
对特定文件/目录进行针对性安全检查
deps [path]
deps
依赖项锁定文件分析
secrets [path]
secrets
仅密钥正则扫描
compliance <standard>
compliance
SOC2/GDPR/HIPAA启发式检查清单
report
report
问题的可视化仪表盘展示
无法识别的输入—请求用户澄清

Empty / Help Gallery

空参数/帮助展示

When 
$ARGUMENTS
is empty, show the dispatch table above plus examples:
  • /security-scanner scan
  • /security-scanner check src/auth/
  • /security-scanner deps
  • /security-scanner secrets
  • /security-scanner compliance soc2
  • /security-scanner report
State that a full scan runs only after the user picks a mode (for example 
scan
); empty invocation is menu-only.
当
$ARGUMENTS
为空时，显示上述调度表及示例：
  • /security-scanner scan
  • /security-scanner check src/auth/
  • /security-scanner deps
  • /security-scanner secrets
  • /security-scanner compliance soc2
  • /security-scanner report
需说明：仅当用户选择模式（例如
scan
）后才会运行完整扫描；空调用仅显示菜单。

Mode: scan

模式：scan

Full codebase security assessment with triage and sampling for large codebases.
针对大型代码库进行全代码库安全评估，包含分类筛选和抽样。

Step 1: Triage

步骤1：分类筛选

  1. Enumerate files: 
    find
    or Glob to build file inventory
  2. Risk-stratify files into HIGH/MEDIUM/LOW security relevance:
    • HIGH: auth, crypto, payments, user input handling, API endpoints, config with secrets
    • MEDIUM: data models, middleware, utilities touching external I/O
    • LOW: static assets, tests, documentation, pure computation
  3. For 100+ files: sample — all HIGH, 50% MEDIUM, 10% LOW
  4. Build dependency graph of HIGH-risk files
  1. 枚举文件：使用
    find
    或Glob构建文件清单
  2. 将文件按安全相关性分为高/中/低风险：
    • 高风险：认证、加密、支付、用户输入处理、API端点、含密钥的配置文件
    • 中风险：数据模型、中间件、涉及外部I/O的工具类
    • 低风险：静态资源、测试、文档、纯计算代码
  3. 文件数量≥100时进行抽样：扫描所有高风险文件、50%中风险文件、10%低风险文件
  4. 构建高风险文件的依赖关系图

Step 2: SAST Pattern Scan

步骤2：SAST模式扫描

Read HIGH and sampled MEDIUM/LOW files. Match against patterns from 
references/owasp-patterns.md
:
  • Injection flaws (SQL, command, path traversal, template, LDAP)
  • Authentication/session weaknesses
  • Sensitive data exposure (logging PII, plaintext storage)
  • XXE, SSRF, deserialization
  • Security misconfiguration
  • XSS (reflected, stored, DOM)
  • Insecure direct object references
  • Missing access controls
  • CSRF vulnerabilities
  • Using components with known vulnerabilities
读取高风险及抽样的中/低风险文件，匹配
references/owasp-patterns.md
中的模式：
  • 注入漏洞（SQL、命令、路径遍历、模板、LDAP）
  • 认证/会话弱点
  • 敏感数据暴露（记录PII、明文存储）
  • XXE、SSRF、反序列化漏洞
  • 安全配置错误
  • XSS（反射型、存储型、DOM型）
  • 不安全的直接对象引用
  • 缺失访问控制
  • CSRF漏洞
  • 使用存在已知漏洞的组件

Step 3: Secrets Scan

步骤3：密钥扫描

Run: 
uv run python scripts/secrets-detector.py <path>
Parse JSON output. Cross-reference findings with 
.gitignore
coverage.
运行：
uv run python scripts/secrets-detector.py <path>
解析JSON输出，将结果与
.gitignore
覆盖范围交叉验证。

Step 4: Dependency Check

步骤4：依赖项检查

If lockfiles exist, run: 
uv run python scripts/dependency-checker.py <path>
Parse JSON output. Flag outdated or unmaintained dependencies.
若存在锁定文件，运行：
uv run python scripts/dependency-checker.py <path>
解析JSON输出，标记过时或无人维护的依赖项。

Step 5: CWE/OWASP Mapping

步骤5：CWE/OWASP映射

Map each finding to CWE IDs and OWASP Top 10 categories using 
references/cwe-patterns.md
. Assign severity (CRITICAL/HIGH/MEDIUM/LOW/INFO) and confidence (0.0-1.0).
使用
references/cwe-patterns.md
将每个问题映射到CWE ID和OWASP Top 10类别。 分配严重性（CRITICAL/HIGH/MEDIUM/LOW/INFO）和置信度（0.0-1.0）。

Step 6: Remediation

步骤6：修复建议

For each finding with confidence >= 0.7, provide:
  • CWE reference link
  • Specific remediation guidance
  • Code example when applicable
针对置信度≥0.7的每个问题，提供：
  • CWE参考链接
  • 特定修复指导
  • 适用时提供代码示例

Step 7: Report

步骤7：报告

Present findings grouped by severity. Include:
  • Executive summary with finding counts by severity
  • Detailed findings with CWE, OWASP, evidence, remediation
  • Dependency health summary (if lockfiles scanned)
  • Secrets summary (count by type, no values exposed)
按严重性分组展示问题，包含：
  • 按严重性统计问题数量的执行摘要
  • 包含CWE、OWASP、证据、修复建议的详细问题列表
  • 依赖项健康摘要（若扫描了锁定文件）
  • 密钥摘要（按类型统计数量，不暴露实际值）

Mode: check

模式：check

Targeted security check on specific files or directories.
  1. Read the specified file(s)
  2. Apply full SAST pattern matching (no triage/sampling — scan everything)
  3. Run secrets detection on the path
  4. Map findings to CWE/OWASP
  5. Present findings with remediation
对特定文件或目录进行针对性安全检查。
  1. 读取指定文件
  2. 应用完整SAST模式匹配（无分类筛选/抽样 — 扫描所有内容）
  3. 对路径进行密钥检测
  4. 将问题映射到CWE/OWASP
  5. 展示问题及修复建议

Mode: deps

模式：deps

Dependency lockfile analysis.
  1. Detect lockfiles: 
    package-lock.json
    , 
    yarn.lock
    , 
    pnpm-lock.yaml
    , 
    requirements.txt
    , 
    uv.lock
    , 
    Cargo.lock
    , 
    go.sum
    , 
    Gemfile.lock
    , 
    composer.lock
  2. Run: 
    uv run python scripts/dependency-checker.py <path>
  3. Parse output: dependency names, versions, ecosystem
  4. Flag: outdated packages, packages with known CVE patterns, unusual version pinning
  5. Present dependency health report
依赖项锁定文件分析。
  1. 检测锁定文件：
    package-lock.json
    、
    yarn.lock
    、
    pnpm-lock.yaml
    、
    requirements.txt
    、
    uv.lock
    、
    Cargo.lock
    、
    go.sum
    、
    Gemfile.lock
    、
    composer.lock
  2. 运行：
    uv run python scripts/dependency-checker.py <path>
  3. 解析输出：依赖项名称、版本、生态系统
  4. 标记：过时包、存在已知CVE模式的包、异常版本固定
  5. 展示依赖项健康报告

Mode: secrets

模式：secrets

Secrets-only scan using regex patterns.
  1. Run: 
    uv run python scripts/secrets-detector.py <path>
  2. Parse JSON findings
  3. Cross-reference with 
    .gitignore
    — flag secrets in tracked files as CRITICAL
  4. Check git history for previously committed secrets: 
    git log --diff-filter=D -p -- <file>
  5. Present findings grouped by secret type, never exposing actual values
使用正则模式进行仅密钥扫描。
  1. 运行：
    uv run python scripts/secrets-detector.py <path>
  2. 解析JSON结果
  3. 与
    .gitignore
    交叉验证 — 已跟踪文件中的密钥标记为CRITICAL
  4. 检查git历史中已提交的密钥：
    git log --diff-filter=D -p -- <file>
  5. 按密钥类型分组展示结果，绝不暴露实际值

Mode: compliance

模式：compliance

Lightweight compliance heuristic scoring.
  1. Validate 
    <standard>
    is one of: 
    soc2
    , 
    gdpr
    , 
    hipaa
  2. Run: 
    uv run python scripts/compliance-scorer.py <path> --standard <standard>
  3. Read reference checklist from 
    references/compliance-checklists.md
  4. Score each control as PASS/FAIL/PARTIAL with evidence
  5. Present compliance scorecard with overall percentage and failing controls
轻量级合规性启发式评分。
  1. 验证
    <standard>
    为以下之一：
    soc2
    、
    gdpr
    、
    hipaa
  2. 运行：
    uv run python scripts/compliance-scorer.py <path> --standard <standard>
  3. 读取
    references/compliance-checklists.md
    中的参考检查清单
  4. 将每个控制项评分标记为PASS/FAIL/PARTIAL并提供证据
  5. 展示合规性评分卡，包含总体百分比和未通过的控制项

Mode: report

模式：report

Generate visual security dashboard.
  1. Collect all findings from the current session (or re-run scan if none exist)
  2. Format findings as JSON matching the dashboard schema
  3. Convert to SARIF if requested: 
    uv run python scripts/sarif-formatter.py
  4. Inject JSON into 
    templates/dashboard.html
  5. Copy to a temporary file, open in browser
生成可视化安全仪表盘。
  1. 收集当前会话中的所有问题（若无则重新运行扫描）
  2. 将问题格式化为符合仪表盘 schema 的JSON
  3. 若请求则转换为SARIF格式：
    uv run python scripts/sarif-formatter.py
  4. 将JSON注入
    templates/dashboard.html
  5. 复制到临时文件并在浏览器中打开

Scaling Strategy

扩展策略

ScopeStrategy
1-10 filesDirect scan, no triage
11-100 filesTriage + prioritized scan
100-500 filesTriage + sampling (all HIGH, 50% MEDIUM, 10% LOW)
500+ filesTriage + sampling + parallel subagents by risk tier
范围策略
1-10个文件直接扫描，无需分类筛选
11-100个文件分类筛选 + 优先级扫描
100-500个文件分类筛选 + 抽样（所有高风险、50%中风险、10%低风险）
500+个文件分类筛选 + 抽样 + 按风险层级并行调用子Agent

Reference Files

参考文件

Load ONE reference at a time. Do not preload all references into context.
FileContentRead When
references/owasp-patterns.mdOWASP Top 10 with code patterns and detection heuristicsDuring SAST scan (Step 2)
references/cwe-patterns.mdTop 50 CWEs with detection patterns and remediationDuring CWE mapping (Step 5)
references/secrets-guide.mdSecret patterns, false positive hints, triage guidanceDuring secrets scan
references/dependency-audit.mdDependency audit protocol and CVE lookup workflowDuring deps mode
references/compliance-checklists.mdSOC2/GDPR/HIPAA control checklists with scoringDuring compliance mode
references/triage-protocol.mdRisk stratification methodology for security filesDuring triage (Step 1)
references/scope-boundary.mdBoundary with review, pen testing, runtime monitoringWhen scope is unclear
ScriptWhen to Run
scripts/secrets-detector.pySecrets scan — regex-based detection
scripts/dependency-checker.pyDependency analysis — lockfile parsing
scripts/sarif-formatter.pySARIF conversion — CI integration output
scripts/compliance-scorer.pyCompliance scoring — heuristic checklist
TemplateWhen to Render
templates/dashboard.htmlAfter scan — inject findings JSON into data tag
每次仅加载一个参考文件。请勿预先将所有参考文件加载到上下文。
文件内容加载时机
references/owasp-patterns.md包含代码模式和检测启发式规则的OWASP Top 10SAST扫描期间（步骤2）
references/cwe-patterns.md包含检测模式和修复建议的Top 50 CWECWE映射期间（步骤5）
references/secrets-guide.md密钥模式、误报提示、分类筛选指导密钥扫描期间
references/dependency-audit.md依赖项审核协议和CVE查询流程deps模式期间
references/compliance-checklists.md包含评分规则的SOC2/GDPR/HIPAA控制项检查清单compliance模式期间
references/triage-protocol.md安全文件的风险分层方法分类筛选期间（步骤1）
references/scope-boundary.md与评审、渗透测试、运行时监控的边界划分范围不明确时
脚本运行时机
scripts/secrets-detector.py密钥扫描 — 基于正则的检测
scripts/dependency-checker.py依赖项分析 — 锁定文件解析
scripts/sarif-formatter.pySARIF转换 — CI集成输出
scripts/compliance-scorer.py合规性评分 — 启发式检查清单
模板渲染时机
templates/dashboard.html扫描后 — 将问题JSON注入数据标签

Critical Rules

关键规则

  1. Never expose actual secret values in output — show type, file, line only
  2. Every finding must map to at least one CWE ID
  3. Confidence < 0.3 = discard; 0.3-0.7 = flag as potential; >= 0.7 = report
  4. Run secrets-detector.py before reporting — regex patterns catch what LLM scanning misses
  5. Do not report phantom vulnerabilities requiring impossible conditions
  6. For 100+ files, always triage before scanning — never brute-force the full codebase
  7. Dependency findings require version evidence — never flag without checking the actual version
  8. Compliance mode is heuristic only — state this explicitly in output, never claim certification
  9. Present findings before suggesting fixes — always use an approval gate
  10. Cross-reference with .gitignore — secrets in untracked files are INFO, in tracked files are CRITICAL
  11. Load ONE reference file at a time — do not preload all references into context
  12. This skill is for pre-deployment audit only — redirect to review for code review, refuse pen testing requests
  13. SARIF output must conform to SARIF v2.1 schema — validate with sarif-formatter.py
  14. Never modify source files — this skill is read-only analysis
  1. 绝不在输出中暴露实际密钥值 — 仅显示类型、文件、行号
  2. 每个问题必须至少映射到一个CWE ID
  3. 置信度<0.3 = 丢弃；0.3-0.7 = 标记为潜在问题；≥0.7 = 报告
  4. 报告前必须运行secrets-detector.py — 正则模式可捕获LLM扫描遗漏的内容
  5. 不得报告需要不可能条件的虚假漏洞
  6. 文件数量≥100时，扫描前必须先进行分类筛选 — 绝不暴力扫描全代码库
  7. 依赖项问题需要版本证据 — 未经实际版本检查不得标记
  8. compliance模式仅为启发式分析 — 输出中需明确说明，绝不声称认证
  9. 建议修复前先展示问题 — 始终使用审批环节
  10. 与.gitignore交叉验证 — 未跟踪文件中的密钥标记为INFO，已跟踪文件中的密钥标记为CRITICAL
  11. 每次仅加载一个参考文件 — 请勿预先将所有参考文件加载到上下文
  12. 本工具仅用于部署前审核 — 代码评审请转向review，拒绝渗透测试请求
  13. SARIF输出必须符合SARIF v2.1 schema — 使用sarif-formatter.py验证
  14. 绝不修改源代码 — 本工具仅为只读分析