什么是 依赖审计技能？

依赖审计技能是为 Openclaw Skills 设计的强大安全工具，旨在保护您的软件供应链。它可以识别多个编程环境（包括 Node.js (npm)、Python (pip)、Rust (Cargo) 和 Go）中的已知漏洞 (CVE)。通过利用 OSV、GitHub Advisory 和 RustSec 等公开咨询数据库，它可以在无需外部 API 令牌或复杂设置的情况下，深入了解项目的依赖树。

该技能基于默认安全理念构建，主要以仅报告模式运行，以防止对代码库进行意外更改。通过与 Openclaw Skills 集成，它允许开发人员通过自动化发现安全风险，并通过建议的修复命令和基于分支的更新提供清晰、可操作的修复路径，从而保持安全态势。

下载入口:https://github.com/openclaw/skills/tree/main/skills/tkuehnl/dep-audit

安装与下载

1. ClawHub CLI

从源直接安装技能的最快方式。

2. 手动安装

将技能文件夹复制到以下位置之一

优先级：工作区 > 本地 > 内置

3. 提示词安装

将此提示词复制到 OpenClaw 即可自动安装。

依赖审计技能 应用场景

• 在生产发布前扫描本地存储库中的关键漏洞。
• 识别共享目录中多个项目里过时或不安全的包。
• 生成 CycloneDX 软件物料清单 (SBOM) 以用于合规性文档。
• 通过 Openclaw Skills 在开发生命周期中自动化安全检查。
• 快速识别新披露的 CVE 是否影响任何当前项目依赖项。

1. 该技能启动检测阶段，扫描目标目录以寻找受支持的锁文件，如 package-lock.json、requirements.txt 或 Cargo.lock。
2. 它检查主机系统上是否存在原生审计工具，以确保可以安全地执行扫描。
3. 为每个检测到的生态系统（npm、pip、Cargo 或 Go）运行专用脚本以查询漏洞数据库。
4. 来自所有生态系统的结果被传输到聚合器，将数据标准化为统一的 JSON 结构。
5. 生成一份全面的 Markdown 报告，为用户优先列出严重和高危发现。
6. 如果有要求，该技能会提供特定的 shell 命令来修复漏洞，在执行前需要用户明确确认。

依赖审计技能 配置指南

要将此技能与 Openclaw Skills 配合使用，请确保系统中安装了 jq，因为它是数据聚合所必需的。不需要额外的 API 密钥或配置文件。

# 验证您的环境是否就绪
bash scripts/detect.sh .

# 如果需要，为 npm 项目运行手动审计
bash scripts/audit-npm.sh /path/to/project

该技能利用标准系统工具。请确保为您希望扫描的特定语言安装了相关的 CLI 工具（如 npm 或 cargo-audit）。

依赖审计技能 数据架构与分类体系

依赖审计技能产生结构化数据，以确保透明度和易于集成。它主要利用统一的 JSON 格式进行程序化访问，并利用 Markdown 格式进行人工审查。

name: dep-audit
description: >
  Audit project dependencies for known vulnerabilities (CVEs).
  Supports npm, pip, Cargo, and Go. Zero API keys required.
  Safe-by-default: report-only mode, fix commands require confirmation.
version: 0.1.3
author: Anvil AI
tags: [security, audit, dependencies, cve, supply-chain, discord, discord-v2]

Dependency Audit Skill

Detect and report known vulnerabilities in your project's dependency tree. Supports npm, pip (Python), Cargo (Rust), and Go out of the box. No API keys. No config. Just point it at a project.

Activation

This skill activates when the user mentions:

• "audit", "vulnerability", "CVE", "dependency check", "supply chain", "security scan"
• Checking dependencies, lockfiles, or packages for issues
• Generating an SBOM (Software Bill of Materials)

Example Prompts

1. "Audit this project for vulnerabilities"
2. "Check all my repos in ~/projects for known CVEs"
3. "Are there any critical vulnerabilities I should fix right now?"
4. "Generate an SBOM for this project"
5. "What dependencies need updating in this project?"
6. "Audit only the Python dependencies"

Permissions

permissions:
  exec: true          # Required to run audit CLIs
  read: true          # Read lockfiles
  write: on-request   # SBOM generation writes sbom.cdx.json when user asks
  network: true       # Tools fetch advisory DBs

Agent Workflow

Follow this sequence exactly:

Step 1: Detect

Run the detection script to discover lockfiles and available tools:

bash /scripts/detect.sh 

If no target directory is given, use the current working directory (.).

Parse the JSON output. Note which ecosystems have lockfiles and which tools are available.

Step 2: Audit Each Ecosystem

For each ecosystem detected in Step 1:

• If the audit tool is available, run the corresponding script:

  bash /scripts/audit-npm.sh 
  bash /scripts/audit-pip.sh 
  bash /scripts/audit-cargo.sh 
  bash /scripts/audit-go.sh 
  

• If the tool is missing, tell the user which tool is needed and the install command from the detect output. Skip that ecosystem and continue with others.

Note: yarn.lock and pnpm-lock.yaml are detected as yarn and pnpm ecosystems respectively. Audit support is npm-only in v0.1.x (package-lock.json). If only a yarn.lock or pnpm-lock.yaml is present, inform the user that dedicated yarn/pnpm audit is not yet supported and suggest running yarn audit or pnpm audit manually.

Each script outputs normalized JSON to stdout.

Step 3: Aggregate

Pipe or pass all per-ecosystem JSON results to the aggregator:

bash /scripts/aggregate.sh   ... 1>unified.json 2>report.md

The aggregator outputs unified JSON to stdout and a Markdown report to stderr. Capture both: 2>report.md for the Markdown, 1>unified.json for the JSON.

Step 4: Present Results

Show the user the Markdown report from the aggregator. Highlight:

• Total vulnerability count by severity
• Critical and High findings first (these need attention)
• Which ecosystems were scanned vs skipped

If zero vulnerabilities found: report "? No known vulnerabilities found." If no lockfiles found: report "No lockfiles found in

I found these fix commands:
  1. cd /home/user/project && npm audit fix
  2. pip install requests>=2.31.0

I recommend creating a branch first:
  git checkout -b dep-audit-fixes

Shall I run them? (yes/no)

bash /scripts/sbom.sh