Back to Details

security-check

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

security-check

security-check

Knowledge/strategy skill for security alert triage. Classifies, prioritizes, and prescribes action. Does not open PRs or modify repos. For execution, use 
/security-runner
.
Install via npx:
bash
npx skills add fellowship-dev/dogfooded-skills/skills/ops/security-check
用于安全警报分类的知识/策略skill。可对警报进行分类、划分优先级并指定应对措施。 不会创建PR或修改仓库。如需执行操作，请使用
/security-runner
。
通过npx安装：
bash
npx skills add fellowship-dev/dogfooded-skills/skills/ops/security-check

When to Use

使用场景

  • Before running 
    /security-runner
    on a repo to understand what actions to expect
  • When manually reviewing a batch of Dependabot/Snyk alerts
  • When onboarding a new repo to the security triage pipeline
  • Weekly cron alongside entropy-check for full health signal
  • 在对仓库运行
    /security-runner
    之前，了解预期执行的操作
  • 手动批量审核Dependabot/Snyk警报时
  • 将新仓库接入安全分类流程时
  • 每周定时任务搭配entropy-check，获取完整的健康状态信号

Classification Model

分类模型

Two dimensions determine priority:
Dimension 1 — Severity (from CVE/advisory): 
critical
| 
high
| 
medium
| 
low
Dimension 2 — Exploitability (from context): 
network-reachable
| 
dev-only
| 
test-only
  • network-reachable: the vulnerable package is in a runtime dependency exposed to the internet
  • dev-only: the package is a 
    devDependency
    / build tool, not shipped to production
  • test-only: only used in tests, never runs in production
优先级由两个维度决定：
维度1 — 严重性（来自CVE/安全公告）：
critical
| 
high
| 
medium
| 
low
维度2 — 可利用性（来自上下文）：
network-reachable
| 
dev-only
| 
test-only
  • network-reachable：存在漏洞的包属于暴露在互联网中的运行时依赖
  • dev-only：该包是
    devDependency
    /构建工具，不会被部署到生产环境
  • test-only：仅在测试中使用，永远不会在生产环境运行

Decision Matrix

决策矩阵

                    | network-reachable | dev-only | test-only
--------------------+-------------------+----------+----------
critical            | P0 — patch now    | P1       | P2
high                | P1 — this week    | P2       | P2
medium              | P2 — batch next   | backlog  | dismiss
low                 | backlog           | dismiss  | dismiss
                    | network-reachable | dev-only | test-only
--------------------+-------------------+----------+----------
critical            | P0 — 立即修复补丁 | P1       | P2
high                | P1 — 本周内处理   | P2       | P2
medium              | P2 — 下次批量处理 | 待办队列 | 驳回
low                 | 待办队列          | 驳回     | 驳回

Action per Priority

各优先级对应操作

PriorityActionLabel
P0Open fix PR immediately; block deploys if no patch exists
security
P0
P1Open fix PR this week
security
P1
P2Create issue with upgrade path; batch in monthly cycle
security
P2
BacklogCreate issue, no urgency
security
DismissDismiss via API with documented reason—
优先级操作标签
P0立即创建修复PR；若无可用补丁则阻止部署
security
P0
P1本周内创建修复PR
security
P1
P2创建包含升级路径的Issue；纳入月度批量处理周期
security
P2
待办队列创建Issue，无紧急处理需求
security
驳回通过API驳回并记录原因—

Auto-Patch Criteria

自动补丁标准

A patch is safe to auto-merge (open PR without manual review) when ALL of the following are true:
  1. Patch-version bump only — e.g., 
    1.2.3 → 1.2.4
    . Minor or major bumps require manual review.
  2. CVE is fixed in the patch — verify via the GitHub advisory or NVD entry.
  3. No breaking changes — scan the package CHANGELOG for the target version range.
  4. CI passes — the update must not break existing tests.
If any criterion fails → manual review required before merging.
当满足以下所有条件时，补丁可安全自动合并（无需人工审核即可创建PR）：
  1. 仅补丁版本升级 — 例如：
    1.2.3 → 1.2.4
    。次要版本或主要版本升级需要人工审核。
  2. 补丁已修复CVE漏洞 — 通过GitHub安全公告或NVD条目验证。
  3. 无破坏性变更 — 扫描目标版本范围内的包CHANGELOG。
  4. CI通过 — 更新不能破坏现有测试。
如果任何一项标准不满足 → 合并前必须进行人工审核。

Merge Strategy Awareness

合并策略注意事项

CRITICAL: Never auto-merge security patches on restricted repos.
Before opening or merging any PR, check the repo's 
merge_strategy
in 
crew.yml
:
bash
MERGE_STRATEGY=$(cat crew.yml 2>/dev/null | grep merge_strategy | head -1 | awk '{print $2}')
merge_strategyAction
auto-merge
Safe patches can be merged automatically after CI green
restricted
Apply label 
ready-to-merge
; human reviews and merges manually
(missing/unknown)Treat as 
restricted
— fail safe
Example restricted repos: Lexgo. When in doubt, treat as restricted.
重要提示：切勿在受限仓库上自动合并安全补丁。
在创建或合并任何PR之前，检查仓库
crew.yml
中的
merge_strategy
：
bash
MERGE_STRATEGY=$(cat crew.yml 2>/dev/null | grep merge_strategy | head -1 | awk '{print $2}')
merge_strategy操作
auto-merge
安全补丁在CI通过后可自动合并
restricted
添加标签
ready-to-merge
；由人工审核并手动合并
（缺失/未知）按
restricted
处理——优先保证安全
示例受限仓库：Lexgo。如有疑问，按受限仓库处理。

Exploitability Detection

可利用性检测

To determine network-reachability, inspect 
package.json
(or equivalent):
bash
undefined
要判断是否为network-reachable，检查
package.json
（或对应文件）：
bash
undefined

Node.js — check if the package is in dependencies vs devDependencies

Node.js — 检查包属于dependencies还是devDependencies

cat package.json | python3 -c " import sys, json pkg = json.load(sys.stdin) print('runtime:', list(pkg.get('dependencies', {}).keys())) print('dev:', list(pkg.get('devDependencies', {}).keys())) "

```bash
cat package.json | python3 -c " import sys, json pkg = json.load(sys.stdin) print('runtime:', list(pkg.get('dependencies', {}).keys())) print('dev:', list(pkg.get('devDependencies', {}).keys())) "

```bash

Ruby — check Gemfile groups

Ruby — 检查Gemfile分组

grep -A5 'group :development|group :test' Gemfile

```bash
grep -A5 'group :development|group :test' Gemfile

```bash

Python — check if package is in requirements.txt vs requirements-dev.txt

Python — 检查包属于requirements.txt还是requirements-dev.txt

diff <(cat requirements.txt 2>/dev/null) <(cat requirements-dev.txt 2>/dev/null)

If the alert package appears in **both** runtime and dev — classify as **network-reachable**.

---
diff <(cat requirements.txt 2>/dev/null) <(cat requirements-dev.txt 2>/dev/null)

如果警报涉及的包同时出现在**运行时依赖和开发依赖**中——分类为**network-reachable**。

---

OpenSSF Scorecard Integration

OpenSSF Scorecard集成

Attribution: ossf/scorecard by OpenSSF contributors (Apache 2.0). Run before building custom security grades — scorecard covers 18 security checks out of the box.
Run scorecard to supplement alert triage with repo-level security posture:
bash
undefined
来源说明：ossf/scorecard 由OpenSSF贡献者开发（Apache 2.0协议）。 在构建自定义安全评级前运行该工具——scorecard默认包含18项安全检查。
运行scorecard以补充仓库级安全态势的警报分类：
bash
undefined

Install (one-time)

安装（仅需一次）

go install sigs.k8s.io/scorecard/v4@latest
go install sigs.k8s.io/scorecard/v4@latest

Run against target repo

针对目标仓库运行

scorecard --repo github.com/{org}/{repo} --format json 2>/dev/null |
jq '.checks[] | {name: .name, score: .score, reason: .reason}' |
grep -E '"score": [0-7]' # Surface low-scoring checks

Scores 0-10 per check. Checks to prioritize:
- **Token-Permissions** (< 7): workflows using excessive token scopes
- **Branch-Protection** (< 7): missing branch rules
- **Dependency-Update-Tool** (< 7): no Dependabot or Renovate configured
- **Vulnerabilities** (< 10): known CVEs in dependencies

Feed scorecard output into entropy-check grades — security score signals go into the `D/F` grade bucket.

---
scorecard --repo github.com/{org}/{repo} --format json 2>/dev/null |
jq '.checks[] | {name: .name, score: .score, reason: .reason}' |
grep -E '"score": [0-7]' # 显示低分检查项

每项检查得分0-10分。需优先关注的检查项：
- **Token-Permissions**（<7分）：工作流使用了过高权限的令牌
- **Branch-Protection**（<7分）：缺失分支规则
- **Dependency-Update-Tool**（<7分）：未配置Dependabot或Renovate
- **Vulnerabilities**（<10分）：依赖中存在已知CVE漏洞

将scorecard输出传入entropy-check评级——安全得分信号归入`D/F`评级类别。

---

Cron Integration

定时任务集成

Add to 
crew.yml
for weekly automated triage:
yaml
cron:
  - schedule: "0 5 * * 1"   # Every Monday at 05:00
    task: "Weekly security triage: process open Dependabot/Snyk alerts on all active repos, open fix PRs for safe patches, create issues for breaking changes"
添加到
crew.yml
以实现每周自动分类：
yaml
cron:
  - schedule: "0 5 * * 1"   # 每周一05:00
    task: "Weekly security triage: process open Dependabot/Snyk alerts on all active repos, open fix PRs for safe patches, create issues for breaking changes"

Output Contract

输出规范

After classifying a batch of alerts, produce a triage summary:
Security Triage: {org}/{repo}
Date: YYYY-MM-DD
Alerts scanned: N

P0 (patch now):    X alerts
P1 (this week):    Y alerts
P2 (batch next):   Z alerts
Backlog:           A alerts
Dismissed:         B alerts

Action required:
- [CRITICAL][net-reachable] lodash@4.17.20 → CVE-2021-23337 — patch to 4.17.21 (safe, patch-only)
- [HIGH][dev-only] webpack@4.46.0 → CVE-2023-28154 — P2, no runtime exposure
完成批量警报分类后，生成分类摘要：
Security Triage: {org}/{repo}
Date: YYYY-MM-DD
Alerts scanned: N

P0 (patch now):    X alerts
P1 (this week):    Y alerts
P2 (batch next):   Z alerts
Backlog:           A alerts
Dismissed:         B alerts

Action required:
- [CRITICAL][net-reachable] lodash@4.17.20 → CVE-2021-23337 — patch to 4.17.21 (safe, patch-only)
- [HIGH][dev-only] webpack@4.46.0 → CVE-2023-28154 — P2, no runtime exposure

Related Skills

相关Skills

  • /security-runner
    — executes the triage: opens PRs, creates issues, dismisses via API
  • /entropy-check
    — doc/architecture health; scorecard scores can feed into entropy grades
  • /maintenance
    — checks Dependabot coverage (is Dependabot even configured?)
  • /deps-runner
    — handles non-security dependency updates; follows same PR pattern
  • /security-runner
    — 执行分类操作：创建PR、生成Issue、通过API驳回警报
  • /entropy-check
    — 文档/架构健康检查；scorecard得分可纳入entropy评级
  • /maintenance
    — 检查Dependabot覆盖情况（是否已配置Dependabot？）
  • /deps-runner
    — 处理非安全相关的依赖更新；遵循相同的PR模式