dependency-audit

Dependency Security Audit

Applicable Scenarios

• Third-party dependency vulnerability scanning
• Container image security scanning
• Git history secret leak detection
• SBOM (Software Bill of Materials) generation
• Supply chain security assessment
• CI/CD security gate configuration

Division of labor with other skills

Scenario	What to use
Dependency/container/secret scanning	This skill
Web vulnerability scanning (DAST)	web-vulnerability/
Authentication and authorization security audit	auth-security-audit/
Penetration testing	reverse-pentest workflow

---

Core Commands

Node.js dependency scanning

# npm 内置审计
npm audit
npm audit fix
npm audit --production  # 只看生产依赖

# pnpm 审计
pnpm audit
pnpm audit --fix

# Snyk（更全面）
npx snyk test
npx snyk monitor  # 持续监控

# 查看过时依赖
pnpm outdated
npx npm-check-updates  # 列出可升级

Java dependency scanning

# OWASP Dependency-Check
./gradlew dependencyCheckAnalyze
# 报告在 build/reports/dependency-check-report.html

# Maven
mvn org.owasp:dependency-check-maven:check

# Snyk
snyk test --all-projects

Python dependency scanning

# Safety
pip install safety
safety check

# pip-audit（官方推荐）
pip install pip-audit
pip-audit

# Snyk
snyk test --file=requirements.txt

Container image scanning

# Trivy（推荐，最全面）
trivy image myapp:latest
trivy image --severity HIGH,CRITICAL myapp:latest

# Docker Scout（Docker 官方）
docker scout cves myapp:latest
docker scout quickview myapp:latest

# Grype
grype myapp:latest

Git secret scanning

# Gitleaks（推荐）
gitleaks detect --source .
gitleaks detect --source . --report-format json --report-path report.json

# 只扫描未提交的变更
gitleaks protect --staged

# TruffleHog
trufflehog git file://. --only-verified

IaC scanning

# Trivy（支持 Terraform/CloudFormation/Docker）
trivy config .
trivy config --severity HIGH,CRITICAL .

# Checkov
checkov -d .
checkov --framework terraform -d ./infra

---

CI integration (GitHub Actions)

# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]

jobs:
  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # Node.js 依赖审计
      - run: npm audit --audit-level=high
      
      # 密钥泄露检测
      - uses: gitleaks/gitleaks-action@v2
      
      # 容器扫描（如有 Dockerfile）
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          severity: HIGH,CRITICAL
          exit-code: 1

---

Handling Strategy

发现高危漏洞时：
  1. 检查是否影响生产（只在 devDependencies？）
  2. 有补丁 → 立即升级
  3. 无补丁 → 评估替代库 or 临时缓解
  4. 误报 → 加入 ignore list（备注原因）

severity 对应 SLA：
  CRITICAL → 24h 内修复
  HIGH     → 7 天内修复
  MEDIUM   → 下个迭代修复
  LOW      → 评估后决定

---

Supporting Templates

• templates/dependency-audit-template.md

Common Pitfalls

1. npm audit 报100+ 漏洞 → 大多数在 devDependencies，先过滤
2. 强制 npm audit fix → 可能引入破坏性升级
3. 忽略间接依赖 → 供应链攻击就从间接依赖来
4. 只扫不修 → 扫描结果没人看等于没扫
5. 不配 CI 门禁 → 新漏洞照样进代码
6. 密钥已提交再删 → Git 历史里还在（需要 rewrite）
7. 容器用 latest → 基础镜像漏洞无法追溯
8. 不生成 SBOM → 出事后不知道用了什么

Collaboration with other skills

上游：
  backend-engineer / frontend-engineer → 代码 + 依赖
  devops-engineer → 容器镜像 + IaC

下游：
  ci-cd-pipeline → 安全门禁
  security-report → 安全报告