vuln-check

Agent Skills › ccch1mneyyy/dsh-Go › vuln-check

vuln-check

GitHub

检查依赖项和代码路径中的安全漏洞，追踪未授权输入、扫描密钥泄露，并按严重程度报告发现及修复建议。

.agents/skills/vuln-check/SKILL.md ccch1mneyyy/dsh-Go

Trigger Scenarios

安全审计 /vuln-check

Install

npx skills add ccch1mneyyy/dsh-Go --skill vuln-check -g -y

More Options

Non-standard path

npx skills add https://github.com/ccch1mneyyy/dsh-Go/tree/main/.agents/skills/vuln-check -g -y

Use without installing

npx skills use ccch1mneyyy/dsh-Go@vuln-check

指定 Agent (Claude Code)

npx skills add ccch1mneyyy/dsh-Go --skill vuln-check -a claude-code -g -y

安装 repo 全部 skill

npx skills add ccch1mneyyy/dsh-Go --all -g -y

预览 repo 内 skill

npx skills add ccch1mneyyy/dsh-Go --list

SKILL.md

Frontmatter

{
    "name": "vuln-check",
    "description": "Check resolved dependencies and relevant code paths for security vulnerabilities. Use for security checks or \/vuln-check; use audit for a broader correctness and maintainability assessment."
}

Assess the requested security surface with evidence. A check returns findings; implement remediation when the user has requested it.

Read app/pubspec.yaml, packages/*/pubspec.yaml, sdk/plugin-kit/package.json and the relevant lockfiles for the affected dependency paths. Use current advisory data for the ecosystem involved, and record the resolved version, advisory, affected range, and verified fixed version where available. Distinguish a dependency advisory match from a demonstrated exploit path in this project.
Trace untrusted inputs through guards to sensitive operations: shell execution, filesystem access, plugin capabilities, WebView/HTML injection, and bridge HTTP routes. For paths, check containment and symlink behavior where relevant; normalization alone does not prevent traversal. Inspect actual validation and authorization before treating a suspicious API as a vulnerability. Scan committed repository files for potential secrets; report only the path, line, and secret type, never the value or a source excerpt.
Report findings by severity with location, trigger, impact, evidence, and the smallest effective remedy. Separate confirmed issues from leads needing verification. Preserve the upstream peer/dev dependency contract when proposing upgrades.
State the scope, sources checked, and gaps. If advisories are unavailable, report that the dependency check is incomplete; absence of findings is not a claim that the project is vulnerability-free.

Report potential secrets only by path, line, and type, never their value or a source excerpt. Do not run automatic dependency fixes as part of a check; for requested remediation, make targeted changes and validate the affected paths.