Vulnerability Skill

漏洞管理技能

Security vulnerability management for GitLab using

glab api

raw endpoint calls.

使用

glab api

原始端点调用进行GitLab安全漏洞管理。

Quick Reference

快速参考

Operation	Command Pattern	Risk
List vulnerabilities	`glab api projects/:id/vulnerabilities`	-
Get vulnerability	`glab api projects/:id/vulnerabilities/:vuln_id`	-
Confirm vulnerability	`glab api projects/:id/vulnerabilities/:vuln_id/confirm -X POST`	⚠️
Dismiss vulnerability	`glab api projects/:id/vulnerabilities/:vuln_id/dismiss -X POST -f ...`	⚠️
Resolve vulnerability	`glab api projects/:id/vulnerabilities/:vuln_id/resolve -X POST`	⚠️
Revert to detected	`glab api projects/:id/vulnerabilities/:vuln_id/revert -X POST`	⚠️
List findings	`glab api projects/:id/vulnerability_findings`	-

Risk Legend: - Safe | ⚠️ Caution | ⚠️⚠️ Warning | ⚠️⚠️⚠️ Danger

操作	命令模式	风险
列出漏洞	`glab api projects/:id/vulnerabilities`	-
获取漏洞详情	`glab api projects/:id/vulnerabilities/:vuln_id`	-
确认漏洞	`glab api projects/:id/vulnerabilities/:vuln_id/confirm -X POST`	⚠️
驳回漏洞	`glab api projects/:id/vulnerabilities/:vuln_id/dismiss -X POST -f ...`	⚠️
解决漏洞	`glab api projects/:id/vulnerabilities/:vuln_id/resolve -X POST`	⚠️
恢复为已检测状态	`glab api projects/:id/vulnerabilities/:vuln_id/revert -X POST`	⚠️
列出检测结果	`glab api projects/:id/vulnerability_findings`	-

风险说明: - 安全 | ⚠️ 注意 | ⚠️⚠️ 警告 | ⚠️⚠️⚠️ 危险

When to Use This Skill

何时使用此技能

ALWAYS use when:

User mentions "vulnerability", "security issue", "CVE"
User wants to view security scan results
User mentions "SAST", "DAST", "dependency scanning", "container scanning"
User wants to dismiss or resolve security findings
User asks about security dashboard

NEVER use when:

User wants to run security scans (use gitlab-ci)
User wants to configure security settings (use project settings)
User wants general issue tracking (use gitlab-issue)

务必在以下场景使用：

用户提及“漏洞”、“安全问题”、“CVE”
用户想要查看安全扫描结果
用户提及“SAST”、“DAST”、“依赖项扫描”、“容器扫描”
用户想要驳回或解决安全检测结果
用户询问安全仪表板相关内容

请勿在以下场景使用：

用户想要运行安全扫描（请使用gitlab-ci）
用户想要配置安全设置（请使用项目设置）
用户需要通用问题追踪（请使用gitlab-issue）

API Prerequisites

API 前置条件

Required Token Scopes:

read_api

or

api

Permissions:

Read vulnerabilities: Developer+
Manage vulnerabilities: Developer+

GitLab Tier: Ultimate required for full vulnerability management features

所需令牌权限范围:

read_api

或

api

权限要求：

读取漏洞：开发者及以上权限
管理漏洞：开发者及以上权限

GitLab 版本: 完整漏洞管理功能需要Ultimate版本

Vulnerability States

漏洞状态

State	Description
`detected`	New, unreviewed vulnerability
`confirmed`	Verified as real vulnerability
`dismissed`	Marked as false positive or won't fix
`resolved`	Fixed and no longer present

状态	描述
`detected`	新的、未审核的漏洞
`confirmed`	已验证为真实漏洞
`dismissed`	标记为误报或无需修复
`resolved`	已修复且不再存在

Severity Levels

严重等级

Severity	Description
`critical`	Highest severity, immediate action needed
`high`	Significant risk
`medium`	Moderate risk
`low`	Minor risk
`info`	Informational finding
`unknown`	Severity not determined

严重程度	描述
`critical`	最高严重等级，需立即处理
`high`	重大风险
`medium`	中等风险
`low`	轻微风险
`info`	信息性检测结果
`unknown`	未确定严重程度

Available Commands

可用命令

List Project Vulnerabilities

列出项目漏洞

bash

undefined

bash

undefined

List all vulnerabilities

glab api projects/123/vulnerabilities --method GET

Filter by state

glab api "projects/123/vulnerabilities?state=detected" --method GET

Filter by severity

glab api "projects/123/vulnerabilities?severity=critical,high" --method GET

Filter by multiple criteria

glab api "projects/123/vulnerabilities?state=detected&severity=critical,high" --method GET

With pagination

glab api projects/123/vulnerabilities --paginate

Using project path

glab api "projects/$(echo 'mygroup/myproject' | jq -Rr @uri)/vulnerabilities"

undefined

glab api "projects/$(echo 'mygroup/myproject' | jq -Rr @uri)/vulnerabilities"

undefined

Get Vulnerability Details

获取漏洞详情

bash

undefined

bash

undefined

Get specific vulnerability

glab api projects/123/vulnerabilities/456 --method GET

undefined

glab api projects/123/vulnerabilities/456 --method GET

undefined

Confirm Vulnerability

确认漏洞

Marks a detected vulnerability as confirmed (real security issue).

bash

undefined

将已检测的漏洞标记为已确认（真实安全问题）。

bash

undefined

Confirm vulnerability

glab api projects/123/vulnerabilities/456/confirm --method POST

undefined

glab api projects/123/vulnerabilities/456/confirm --method POST

undefined

Dismiss Vulnerability

驳回漏洞

Marks a vulnerability as dismissed (false positive or accepted risk).

bash

undefined

将漏洞标记为已驳回（误报或可接受风险）。

bash

undefined

Dismiss as false positive

glab api projects/123/vulnerabilities/456/dismiss --method POST
-f comment="False positive - this code path is not reachable"

Dismiss as acceptable risk

glab api projects/123/vulnerabilities/456/dismiss --method POST
-f comment="Accepted risk - mitigated by network controls"

Dismiss with dismissal reason (if available)

glab api projects/123/vulnerabilities/456/dismiss --method POST
-f comment="Not applicable to our use case"
-f dismissal_reason="used_in_tests"

undefined

glab api projects/123/vulnerabilities/456/dismiss --method POST
-f comment="Not applicable to our use case"
-f dismissal_reason="used_in_tests"

undefined

Resolve Vulnerability

解决漏洞

Marks a vulnerability as resolved (fixed).

bash

undefined

将漏洞标记为已解决（已修复）。

bash

undefined

Resolve vulnerability

glab api projects/123/vulnerabilities/456/resolve --method POST

undefined

glab api projects/123/vulnerabilities/456/resolve --method POST

undefined

Revert to Detected State

恢复为已检测状态

Reverts a vulnerability back to detected state.

bash

undefined

将漏洞恢复为已检测状态。

bash

undefined

Revert to detected

glab api projects/123/vulnerabilities/456/revert --method POST

undefined

glab api projects/123/vulnerabilities/456/revert --method POST

undefined

List Vulnerability Findings

列出漏洞检测结果

Findings are the raw results from security scanners.

bash

undefined

检测结果是安全扫描器生成的原始结果。

bash

undefined

List all findings

glab api projects/123/vulnerability_findings --method GET

Filter by severity

glab api "projects/123/vulnerability_findings?severity=critical,high" --method GET

Filter by scanner

glab api "projects/123/vulnerability_findings?scanner=sast" --method GET

Filter by pipeline

glab api "projects/123/vulnerability_findings?pipeline_id=789" --method GET

With pagination

glab api projects/123/vulnerability_findings --paginate

undefined

glab api projects/123/vulnerability_findings --paginate

undefined

Security Dashboard (Group Level)

安全仪表板（群组级别）

bash

undefined

bash

undefined

Get security statistics for group

glab api groups/456/vulnerability_exports --method POST
-f export_format="csv"

Get group vulnerability statistics

glab api "groups/456/vulnerability_statistics" --method GET

undefined

glab api "groups/456/vulnerability_statistics" --method GET

undefined

Common Workflows

常见工作流

Workflow 1: Triage New Vulnerabilities

工作流1：分类新漏洞

bash

project_id=123

bash

project_id=123

Get all detected (new) vulnerabilities

glab api "projects/$project_id/vulnerabilities?state=detected" --paginate |
jq -r '.[] | "[(.severity)] (.title) - (.id)"'

Review critical/high first

glab api "projects/$project_id/vulnerabilities?state=detected&severity=critical,high" |
jq -r '.[] | "ID: (.id)\nTitle: (.title)\nSeverity: (.severity)\nScanner: (.scanner.name)\nLocation: (.location | @json)\n---"'

undefined

glab api "projects/$project_id/vulnerabilities?state=detected&severity=critical,high" |
jq -r '.[] | "ID: (.id)\nTitle: (.title)\nSeverity: (.severity)\nScanner: (.scanner.name)\nLocation: (.location | @json)\n---"'

undefined

Workflow 2: Generate Security Report

工作流2：生成安全报告

bash

project_id=123

bash

project_id=123

Summary by severity

echo "=== Vulnerability Summary ===" glab api "projects/$project_id/vulnerabilities" --paginate |
jq -r 'group_by(.severity) | map({severity: .[0].severity, count: length}) | .[] | "(.severity): (.count)"'

Summary by state

echo "" echo "=== By State ===" glab api "projects/$project_id/vulnerabilities" --paginate |
jq -r 'group_by(.state) | map({state: .[0].state, count: length}) | .[] | "(.state): (.count)"'

Summary by scanner

echo "" echo "=== By Scanner ===" glab api "projects/$project_id/vulnerabilities" --paginate |
jq -r 'group_by(.scanner.name) | map({scanner: .[0].scanner.name, count: length}) | .[] | "(.scanner): (.count)"'

undefined

echo "" echo "=== By Scanner ===" glab api "projects/$project_id/vulnerabilities" --paginate |
jq -r 'group_by(.scanner.name) | map({scanner: .[0].scanner.name, count: length}) | .[] | "(.scanner): (.count)"'

undefined

Workflow 3: Bulk Dismiss False Positives

工作流3：批量驳回误报

bash

project_id=123

bash

project_id=123

Dismiss all info-level findings from specific scanner

glab api "projects/$project_id/vulnerabilities?severity=info&state=detected" --paginate |
jq -r '.[].id' | while read vuln_id; do echo "Dismissing $vuln_id" glab api projects/$project_id/vulnerabilities/$vuln_id/dismiss --method POST
-f comment="Bulk dismissed - info level findings" done

undefined

glab api "projects/$project_id/vulnerabilities?severity=info&state=detected" --paginate |
jq -r '.[].id' | while read vuln_id; do echo "Dismissing $vuln_id" glab api projects/$project_id/vulnerabilities/$vuln_id/dismiss --method POST
-f comment="Bulk dismissed - info level findings" done

undefined

Workflow 4: Track Critical Vulnerabilities

工作流4：追踪关键漏洞

bash

project_id=123

bash

project_id=123

List critical vulnerabilities with details

glab api "projects/$project_id/vulnerabilities?severity=critical" --paginate |
jq -r '.[] | { id: .id, title: .title, state: .state, detected_at: .detected_at, scanner: .scanner.name, identifiers: [.identifiers[]?.name] | join(", ") }'

undefined

glab api "projects/$project_id/vulnerabilities?severity=critical" --paginate |
jq -r '.[] | { id: .id, title: .title, state: .state, detected_at: .detected_at, scanner: .scanner.name, identifiers: [.identifiers[]?.name] | join(", ") }'

undefined

Workflow 5: Check for CVEs

工作流5：检查CVE漏洞

bash

project_id=123
cve="CVE-2021-44228"

bash

project_id=123
cve="CVE-2021-44228"

Search for specific CVE

glab api "projects/$project_id/vulnerabilities" --paginate |
jq -r ".[] | select(.identifiers[]?.name == "$cve") | "ID: (.id), State: (.state), Title: (.title)""

undefined

glab api "projects/$project_id/vulnerabilities" --paginate |
jq -r ".[] | select(.identifiers[]?.name == "$cve") | "ID: (.id), State: (.state), Title: (.title)""

undefined

Workflow 6: Export Vulnerabilities

工作流6：导出漏洞数据

bash

project_id=123

bash

project_id=123

Export to JSON

glab api "projects/$project_id/vulnerabilities" --paginate > vulnerabilities.json

Export to CSV format

glab api "projects/$project_id/vulnerabilities" --paginate |
jq -r '["id","title","severity","state","scanner","detected_at"], (.[] | [.id, .title, .severity, .state, .scanner.name, .detected_at]) | @csv' > vulnerabilities.csv

undefined

glab api "projects/$project_id/vulnerabilities" --paginate |
jq -r '["id","title","severity","state","scanner","detected_at"], (.[] | [.id, .title, .severity, .state, .scanner.name, .detected_at]) | @csv' > vulnerabilities.csv

undefined

Workflow 7: Compare Pipeline Results

工作流7：对比流水线结果

bash

project_id=123

bash

project_id=123

Get findings from specific pipeline

pipeline_id=789 glab api "projects/$project_id/vulnerability_findings?pipeline_id=$pipeline_id" |
jq -r '.[] | "(.severity): (.name)"'

undefined

pipeline_id=789 glab api "projects/$project_id/vulnerability_findings?pipeline_id=$pipeline_id" |
jq -r '.[] | "(.severity): (.name)"'

undefined

Scanner Types

扫描器类型

Scanner	Report Type	Description
`sast`	SAST	Static Application Security Testing
`dast`	DAST	Dynamic Application Security Testing
`dependency_scanning`	Dependency Scanning	Third-party dependency vulnerabilities
`container_scanning`	Container Scanning	Container image vulnerabilities
`secret_detection`	Secret Detection	Hardcoded secrets in code
`coverage_fuzzing`	Coverage Fuzzing	Fuzzing test results
`api_fuzzing`	API Fuzzing	API fuzzing results

扫描器	报告类型	描述
`sast`	SAST	静态应用安全测试
`dast`	DAST	动态应用安全测试
`dependency_scanning`	依赖项扫描	第三方依赖漏洞检测
`container_scanning`	容器扫描	容器镜像漏洞检测
`secret_detection`	密钥检测	代码中的硬编码密钥检测
`coverage_fuzzing`	覆盖模糊测试	模糊测试结果
`api_fuzzing`	API模糊测试	API模糊测试结果

Troubleshooting

故障排除

Issue	Cause	Solution
403 Forbidden	Ultimate required or no access	Check GitLab tier and permissions
Empty results	No scans run	Configure and run security scanners in CI
Old vulnerabilities	No recent pipeline	Run new pipeline with security jobs
Can't dismiss	Already dismissed or resolved	Check current state
Missing scanner type	Scanner not configured	Add scanner to CI configuration

问题	原因	解决方案
403 禁止访问	需要Ultimate版本或无访问权限	检查GitLab版本和权限设置
结果为空	未运行扫描	在CI中配置并运行安全扫描器
漏洞数据过时	未运行最新流水线	运行包含安全任务的新流水线
无法驳回漏洞	漏洞已被驳回或解决	检查漏洞当前状态
缺少扫描器类型	未配置对应扫描器	在CI配置中添加扫描器

Best Practices

最佳实践

Triage regularly: Review new vulnerabilities frequently
Document dismissals: Always add comments explaining why
Track critical issues: Monitor critical/high severity closely
Integrate with issues: Create issues for confirmed vulnerabilities
Automate where possible: Use CI to fail on new critical findings

定期分类: 定期审核新漏洞
记录驳回原因: 始终添加注释说明驳回理由
追踪关键问题: 密切监控严重等级为critical/high的漏洞
与问题追踪集成: 为已确认的漏洞创建问题
尽可能自动化: 在CI中配置新关键漏洞触发失败

gitlab-vulnerability

Original

Translation

Vulnerability Skill

漏洞管理技能

Quick Reference

快速参考

When to Use This Skill

何时使用此技能

API Prerequisites

API 前置条件

Vulnerability States

漏洞状态

Severity Levels

严重等级

Available Commands

可用命令

List Project Vulnerabilities

列出项目漏洞

List all vulnerabilities

List all vulnerabilities

Filter by state

Filter by state

Filter by severity

Filter by severity

Filter by multiple criteria

Filter by multiple criteria

With pagination

With pagination

Using project path

Using project path

Get Vulnerability Details

获取漏洞详情

Get specific vulnerability

Get specific vulnerability

Confirm Vulnerability

确认漏洞

Confirm vulnerability

Confirm vulnerability

Dismiss Vulnerability

驳回漏洞

Dismiss as false positive

Dismiss as false positive

Dismiss as acceptable risk

Dismiss as acceptable risk

Dismiss with dismissal reason (if available)

Dismiss with dismissal reason (if available)

Resolve Vulnerability

解决漏洞

Resolve vulnerability

Resolve vulnerability

Revert to Detected State

恢复为已检测状态

Revert to detected

Revert to detected

List Vulnerability Findings

列出漏洞检测结果

List all findings

List all findings

Filter by severity

Filter by severity

Filter by scanner

Filter by scanner

Filter by pipeline

Filter by pipeline

With pagination

With pagination

Security Dashboard (Group Level)

安全仪表板（群组级别）

Get security statistics for group

Get security statistics for group

Get group vulnerability statistics

Get group vulnerability statistics

Common Workflows

常见工作流

Workflow 1: Triage New Vulnerabilities

工作流1：分类新漏洞

Get all detected (new) vulnerabilities

Get all detected (new) vulnerabilities

Review critical/high first