Back to Details

security-scan

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Security Scan Skill

安全扫描Skill

Overview

概述

Orchestrates the full security scanning workflow across all supported languages.
可对所有支持的编程语言编排完整的安全扫描工作流。

Supported Languages

支持的语言

LanguageMarker FilesPattern Count
JavaScript/TypeScriptpackage.json25+
PHPcomposer.json20+
Pythonrequirements.txt, pyproject.toml18+
Swift/iOSPackage.swift, *.xcodeproj15+
Gogo.mod12+
RustCargo.toml10+
编程语言标识文件检测规则数量
JavaScript/TypeScriptpackage.json25+
PHPcomposer.json20+
Pythonrequirements.txt, pyproject.toml18+
Swift/iOSPackage.swift, *.xcodeproj15+
Gogo.mod12+
RustCargo.toml10+

Workflow

工作流

  1. Detect language from project markers
  2. Load patterns from 
    references/scan-patterns.md
  3. Run 
    scripts/security-scan.sh
    for automated scanning
  4. Map findings to OWASP categories via 
    references/owasp-top10.md
  5. Generate report using 
    references/templates/scan-report.md
  1. 检测：通过项目标识文件判断编程语言
  2. 加载：从
    references/scan-patterns.md
    中加载检测规则
  3. 运行：执行
    scripts/security-scan.sh
    进行自动化扫描
  4. 映射：通过
    references/owasp-top10.md
    将检测结果映射到OWASP分类
  5. 生成：使用
    references/templates/scan-report.md
    生成扫描报告

Pattern Categories

检测规则分类

  • XSS (Cross-Site Scripting)
  • SQL Injection
  • Command Injection
  • Code Execution (eval, exec)
  • SSRF (Server-Side Request Forgery)
  • Weak Cryptography
  • Hardcoded Secrets
  • Insecure Deserialization
  • Path Traversal / LFI / RFI
  • XSS（跨站脚本攻击）
  • SQL注入
  • 命令注入
  • 代码执行（eval、exec）
  • SSRF（服务器端请求伪造）
  • 弱加密算法
  • 硬编码敏感信息
  • 不安全反序列化
  • 路径遍历 / LFI / RFI

Integration

集成

After scanning, delegate fixes to sniper:
Task(subagent_type: "fuse-ai-pilot:sniper")
Prompt: "Security fixes: [FILE:LINE] [VULN] [FIX]"
扫描完成后，可将修复任务委托给sniper：
Task(subagent_type: "fuse-ai-pilot:sniper")
Prompt: "Security fixes: [FILE:LINE] [VULN] [FIX]"

References

参考资料

  • OWASP Top 10 Mapping
  • Scan Patterns by Language
  • Report Template
  • OWASP Top 10 映射
  • 按语言分类的扫描规则
  • 报告模板