@perrylink/dsh-skill-pack-security-provider 2.1.4 → 2.2.3

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 dsh-skill-pack-security contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/lib/index.js

@@ -38,8 +38,9 @@ export const Config = z.object({
         maxExtractBytes: z.natural().min(1024).max(512 * 1024 * 1024).default(64 * 1024 * 1024),
         maxDepNodes: z.natural().min(1).max(10000).default(600),
         maxFindingsPerCheck: z.natural().min(1).max(100).default(12),
-        userAgent: z.string().max(200).default('dsh-skill-pack-security/2.1.4 (+https://github.com/PerryLink/dsh-skill-pack-security)'),
+        userAgent: z.string().max(200).default('dsh-skill-pack-security/2.2.3 (+https://github.com/PerryLink/dsh-skill-pack-security)'),
         dataResponsibility: z.boolean().default(true),
+        externalScanners: z.boolean().default(true),
         gate: z.object({
             policy: z.union(['warn', 'deny']).default('warn'),
         }),

package/lib/types/vet/checks.d.ts

@@ -12,6 +12,7 @@ import { type Lang } from './skills.js';
 import type { VetConfig } from './config.js';
 import type { ScannedFile } from './walk.js';
 import type { CheckId, VetCheck, VetSbom } from './vocabulary.js';
+import type { ScannerResult } from './scanners.js';
 /** Shared inputs every check reads. */
 export interface CheckInputs {
     readonly files: ScannedFile[];
@@ -25,6 +26,8 @@ export interface CheckInputs {
     /** 40-hex HEAD of a local git target, when readable without spawning git. */
     readonly localHead: string;
     readonly now: number;
+    /** Dependency-scanner result (builtin or an external CLI), when computed. */
+    readonly scanner?: ScannerResult;
 }
 /** One check run: the check plus its optional SBOM payload. */
 export interface CheckResult {

package/lib/types/vet/config.d.ts

@@ -19,6 +19,8 @@ export interface VetConfigInput {
     readonly maxFindingsPerCheck?: number;
     readonly userAgent?: string;
     readonly dataResponsibility?: boolean;
+    /** Orchestrate osv-scanner/npm audit when their CLIs are present (default true). */
+    readonly externalScanners?: boolean;
     readonly gate?: {
         readonly policy?: GatePolicy;
     };
@@ -34,6 +36,7 @@ export interface VetConfig {
     readonly maxFindingsPerCheck: number;
     readonly userAgent: string;
     readonly dataResponsibility: boolean;
+    readonly externalScanners: boolean;
     readonly gate: {
         readonly policy: GatePolicy;
     };

package/lib/types/vet/scanners.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Dependency-vulnerability scanner Provider seam.
+ *
+ * The `sbom` check can hand its dependency evidence to an external scanner
+ * (`osv-scanner` or `npm audit`) when that CLI is present, and degrade to the
+ * built-in zero-dependency tree scan otherwise. Every scanner declares its
+ * `source`, so the report never misattributes findings. Probing is
+ * "detect → use → graceful degrade": any spawn failure (CLI absent, sandbox
+ * restriction, non-zero exit, unparseable output) resolves to an unavailable
+ * scanner instead of throwing.
+ *
+ * @module dsh-skill-pack-security/vet/scanners
+ */
+import type { ScannerSource, VulnIssue } from './vocabulary.js';
+/** Result of probing and (optionally) running one scanner. */
+export interface ScannerResult {
+    readonly source: ScannerSource;
+    /** Whether the scanner could run against `dir`. */
+    readonly available: boolean;
+    /** Why it was unavailable (CLI missing, no lockfile, timeout, parse error). */
+    readonly reason?: string;
+    /** Vulnerabilities found; empty on a clean scan or when unavailable. */
+    readonly issues: VulnIssue[];
+}
+/** The Provider contract a dependency scanner implements. */
+export interface DependencyScanner {
+    readonly source: ScannerSource;
+    readonly label: string;
+    /** Whether the scanner can run against `dir` (CLI present + target suitable). */
+    probe(dir: string, timeoutMs: number, signal?: AbortSignal): Promise<boolean>;
+    /** Run the scanner; never throws — failures degrade to an empty issue list. */
+    scan(dir: string, timeoutMs: number, signal?: AbortSignal): Promise<VulnIssue[]>;
+}
+/** osv-scanner adapter: detects the CLI, scans the directory. */
+export declare const osvScanner: DependencyScanner;
+/** npm-audit adapter: detects a lockfile + the npm CLI, runs `npm audit`. */
+export declare const npmAuditScanner: DependencyScanner;
+/**
+ * Probe the external scanners in preference order and return the first that is
+ * available, or a `builtin` result (always available) when none is.
+ * @param dir - the local target directory to scan (external scanners need it).
+ * @param timeoutMs - per-CLI probe/scan timeout.
+ * @param signal - caller abort signal (the tool-call signal).
+ * @returns a result whose `source` names the effective scanner.
+ */
+export declare function probeDependencyScanner(dir: string, timeoutMs: number, signal?: AbortSignal): Promise<ScannerResult>;

package/lib/types/vet/vocabulary.d.ts

@@ -61,6 +61,20 @@ export interface VetPackage {
     /** Whether the entry came from devDependencies only. */
     readonly dev: boolean;
 }
+/** Where the dependency-scan evidence came from. */
+export type ScannerSource = 'builtin' | 'osv-scanner' | 'npm-audit';
+/** One vulnerability reported by a dependency scanner. */
+export interface VulnIssue {
+    /** Advisory id when known (GHSA-…, CVE-…, or npm advisory id). */
+    readonly id?: string;
+    /** Affected package name. */
+    readonly package: string;
+    /** Affected version range, when the scanner reported one. */
+    readonly version?: string;
+    readonly severity: 'critical' | 'high' | 'moderate' | 'low' | 'unknown';
+    /** Short human-readable summary. */
+    readonly title: string;
+}
 /** SBOM summary produced by the `sbom` check. */
 export interface VetSbom {
     readonly lockfile: string | null;
@@ -72,6 +86,10 @@ export interface VetSbom {
     readonly totalPackages: number;
     /** Direct dependency specs that are not pinned to an exact version. */
     readonly unpinned: string[];
+    /** Which scanner produced the dependency evidence (`builtin` = self-computed). */
+    readonly source: ScannerSource;
+    /** Vulnerabilities reported by an external scanner; empty for `builtin`. */
+    readonly vulnerabilities: VulnIssue[];
 }
 /** Scorecard: the five dimensions plus the overall weighted score. */
 export interface VetScores {

package/lib/vet/checks.js

@@ -168,17 +168,19 @@ export function licenseCheck(inputs) {
 }
 // --- sbom --------------------------------------------------------------------
 export function sbomCheck(inputs) {
-    const { manifest, lock, config, lang } = inputs;
+    const { manifest, lock, config, lang, scanner } = inputs;
     const zh = lang === 'zh';
     const findings = [];
     let score = 100;
     const direct = Object.keys(manifest.dependencies).length;
     const dev = Object.keys(manifest.devDependencies).length;
     const unpinned = unpinnedSpecs(manifest);
+    const source = scanner?.source ?? 'builtin';
+    const vulnerabilities = scanner?.issues ?? [];
     if (!manifest.present) {
         return {
             check: makeCheck('sbom', 0, [], lang, config, zh ? '无 package.json，无法生成依赖树' : 'no package.json, cannot build a dependency tree'),
-            sbom: { lockfile: null, directDependencies: 0, directDevDependencies: 0, packages: [], truncated: false, totalPackages: 0, unpinned: [] },
+            sbom: { lockfile: null, directDependencies: 0, directDevDependencies: 0, packages: [], truncated: false, totalPackages: 0, unpinned: [], source, vulnerabilities },
         };
     }
     if (lock.lockfile === null) {
@@ -225,6 +227,8 @@ export function sbomCheck(inputs) {
         truncated: tree.truncated,
         totalPackages: tree.total,
         unpinned,
+        source,
+        vulnerabilities,
     };
     if (tree.truncated) {
         findings.push({
@@ -238,8 +242,48 @@ export function sbomCheck(inputs) {
         message: zh ? `依赖树：${tree.packages.length} 个唯一包（直接 ${direct} + dev ${dev}）${lock.lockfile !== null ? `，锁文件 ${lock.lockfile}${lock.lockfileVersion !== '' ? ` v${lock.lockfileVersion}` : ''}` : ''}` : `dependency tree: ${tree.packages.length} unique packages (direct ${direct} + dev ${dev})${lock.lockfile !== null ? `, lockfile ${lock.lockfile}${lock.lockfileVersion !== '' ? ` v${lock.lockfileVersion}` : ''}` : ''}`,
         skill: SKILL_REF.sbom,
     });
+    // External scanner evidence replaces the self-computed vulnerability view;
+    // its source is annotated so the report never misattributes findings.
+    if (source !== 'builtin') {
+        if (vulnerabilities.length === 0) {
+            findings.push({
+                level: 'info',
+                message: zh ? `外部扫描器（${scannerLabel(source, zh)}）未发现已知漏洞` : `external scanner (${scannerLabel(source, zh)}) found no known vulnerabilities`,
+                skill: SKILL_REF.sbom,
+            });
+        }
+        else {
+            for (const vuln of vulnerabilities) {
+                const severity = vuln.severity;
+                const level = severity === 'critical' || severity === 'high' ? 'fail' : 'warn';
+                findings.push({
+                    level,
+                    message: zh
+                        ? `[${source}] ${vuln.package}${vuln.version !== undefined ? `@${vuln.version}` : ''}：${vuln.title}（${severity}${vuln.id !== undefined ? `, ${vuln.id}` : ''}）`
+                        : `[${source}] ${vuln.package}${vuln.version !== undefined ? `@${vuln.version}` : ''}: ${vuln.title} (${severity}${vuln.id !== undefined ? `, ${vuln.id}` : ''})`,
+                    skill: SKILL_REF.sbom,
+                });
+                score -= level === 'fail' ? 30 : 15;
+            }
+        }
+    }
+    else {
+        findings.push({
+            level: 'info',
+            message: zh ? '依赖扫描来源：内置自算（未探测到 osv-scanner/npm audit CLI）' : 'dependency scan source: builtin (no osv-scanner/npm audit CLI detected)',
+            skill: SKILL_REF.sbom,
+        });
+    }
     return { check: makeCheck('sbom', score, findings, lang, config), sbom };
 }
+/** Human label for a scanner source. */
+function scannerLabel(source, zh) {
+    if (source === 'osv-scanner')
+        return zh ? 'OSV-Scanner' : 'OSV-Scanner';
+    if (source === 'npm-audit')
+        return zh ? 'npm audit' : 'npm audit';
+    return zh ? '内置自算' : 'builtin';
+}
 /** Scan the collected files for git/action refs that must be 40-hex commits. */
 function collectRefHits(files, manifest) {
     const hits = [];

package/lib/vet/config.js

@@ -15,8 +15,9 @@ export const VET_DEFAULTS = {
     maxExtractBytes: 64 * 1024 * 1024,
     maxDepNodes: 600,
     maxFindingsPerCheck: 12,
-    userAgent: 'dsh-skill-pack-security/2.1.4 (+https://github.com/PerryLink/dsh-skill-pack-security)',
+    userAgent: 'dsh-skill-pack-security/2.2.3 (+https://github.com/PerryLink/dsh-skill-pack-security)',
     dataResponsibility: true,
+    externalScanners: true,
     gate: { policy: 'warn' },
 };
 /** Merge raw config over the defaults (the schema already validated shape/ranges). */
@@ -33,6 +34,7 @@ export function resolveVetConfig(raw) {
         maxFindingsPerCheck: raw.maxFindingsPerCheck ?? VET_DEFAULTS.maxFindingsPerCheck,
         userAgent: raw.userAgent ?? VET_DEFAULTS.userAgent,
         dataResponsibility: raw.dataResponsibility ?? VET_DEFAULTS.dataResponsibility,
+        externalScanners: raw.externalScanners ?? VET_DEFAULTS.externalScanners,
         gate: { policy: raw.gate?.policy ?? VET_DEFAULTS.gate.policy },
     };
 }

package/lib/vet/engine.js

@@ -13,6 +13,7 @@ import { runChecks } from './checks.js';
 import { parseLockfile, parseManifest } from './manifest.js';
 import { resolveTarget } from './source.js';
 import { VetFetchError } from './fetch.js';
+import { probeDependencyScanner } from './scanners.js';
 import { CHECK_NAME, SKILL_REF, T } from './skills.js';
 /** Engine-level failure: target unusable (not found, offline, budget). */
 export class VetTargetError extends Error {
@@ -159,7 +160,7 @@ export async function runVet(args, config, lang, signal) {
                 scores: scoreDimensions(checks),
                 verdict: 'skip',
                 gate: { policy, applied: false, blocked: false },
-                sbom: { lockfile: null, directDependencies: 0, directDevDependencies: 0, packages: [], truncated: false, totalPackages: 0, unpinned: [] },
+                sbom: { lockfile: null, directDependencies: 0, directDevDependencies: 0, packages: [], truncated: false, totalPackages: 0, unpinned: [], source: 'builtin', vulnerabilities: [] },
                 budget: { filesScanned: 0, filesSkipped: 0, bytesScanned: 0, truncated: false, truncatedReason: skipReason },
                 followupSkills: ['security-audit'],
             });
@@ -172,6 +173,13 @@ export async function runVet(args, config, lang, signal) {
     const manifest = parseManifest(resolved.files);
     const lock = parseLockfile(resolved.files);
     const localHead = resolved.kind === 'local-path' ? await readLocalHead(resolved.resolved) : '';
+    // External scanners (osv-scanner/npm audit) need a real on-disk project, so
+    // they are orchestrated only for local targets; remote targets degrade to
+    // the built-in tree scan with an explicit `builtin` source annotation.
+    let scanner;
+    if (config.externalScanners && resolved.kind === 'local-path') {
+        scanner = await probeDependencyScanner(resolved.resolved, config.timeoutMs, signal);
+    }
     const results = runChecks({
         files: resolved.files,
         manifest,
@@ -183,6 +191,7 @@ export async function runVet(args, config, lang, signal) {
         lang,
         localHead,
         now,
+        scanner,
     }, effectiveIds);
     const checks = results.map(result => result.check);
     const sbom = results.find(result => result.sbom !== undefined)?.sbom;
@@ -238,6 +247,8 @@ export async function runVet(args, config, lang, signal) {
             truncated: false,
             totalPackages: 0,
             unpinned: [],
+            source: 'builtin',
+            vulnerabilities: [],
         },
         budget,
         followupSkills: [...followupSkills],

package/lib/vet/report.js

@@ -69,7 +69,9 @@ export function renderReport(report, lang) {
         parts.push(renderCheck(check, lang));
     }
     parts.push('');
-    parts.push(`**SBOM** (${report.sbom.lockfile ?? (lang === 'zh' ? '无锁文件' : 'no lockfile')}) — ${lang === 'zh' ? '直接依赖' : 'direct'} ${report.sbom.directDependencies} + dev ${report.sbom.directDevDependencies}, ${lang === 'zh' ? '唯一包' : 'unique packages'} ${report.sbom.packages.length}${report.sbom.totalPackages > report.sbom.packages.length ? ` (${lang === 'zh' ? '总计' : 'total'} ${report.sbom.totalPackages})` : ''}`);
+    const sbomSource = report.sbom.source === 'osv-scanner' ? 'OSV-Scanner' : report.sbom.source === 'npm-audit' ? 'npm audit' : (lang === 'zh' ? '内置自算' : 'builtin');
+    const vulnCount = report.sbom.vulnerabilities.length;
+    parts.push(`**SBOM** (${report.sbom.lockfile ?? (lang === 'zh' ? '无锁文件' : 'no lockfile')}) — ${lang === 'zh' ? '直接依赖' : 'direct'} ${report.sbom.directDependencies} + dev ${report.sbom.directDevDependencies}, ${lang === 'zh' ? '唯一包' : 'unique packages'} ${report.sbom.packages.length}${report.sbom.totalPackages > report.sbom.packages.length ? ` (${lang === 'zh' ? '总计' : 'total'} ${report.sbom.totalPackages})` : ''} · ${lang === 'zh' ? '扫描来源' : 'scan source'}: ${sbomSource}${vulnCount > 0 ? ` · ${lang === 'zh' ? '已知漏洞' : 'known vulns'}: ${vulnCount}` : ''}`);
     if (report.sbom.packages.length > 0) {
         const tree = report.sbom.packages.slice(0, TREE_CAP).map(pkg => `${'  '.repeat(Math.min(pkg.depth, 8))}${pkg.name}@${pkg.version}`).join('\n');
         parts.push('```text');

package/lib/vet/scanners.js

@@ -0,0 +1,198 @@
+/**
+ * Dependency-vulnerability scanner Provider seam.
+ *
+ * The `sbom` check can hand its dependency evidence to an external scanner
+ * (`osv-scanner` or `npm audit`) when that CLI is present, and degrade to the
+ * built-in zero-dependency tree scan otherwise. Every scanner declares its
+ * `source`, so the report never misattributes findings. Probing is
+ * "detect → use → graceful degrade": any spawn failure (CLI absent, sandbox
+ * restriction, non-zero exit, unparseable output) resolves to an unavailable
+ * scanner instead of throwing.
+ *
+ * @module dsh-skill-pack-security/vet/scanners
+ */
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+/** Spawn a CLI, capture output, and always settle (error/timeout → null code). */
+function runCommand(bin, args, cwd, timeoutMs, signal) {
+    return new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn(bin, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+        }
+        catch {
+            resolve({ code: null, stdout: '', stderr: 'spawn threw' });
+            return;
+        }
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve({ code, stdout, stderr });
+        };
+        const timer = setTimeout(() => {
+            try {
+                child.kill();
+            }
+            catch { /* already exited */ }
+            finish(null);
+        }, timeoutMs);
+        const onAbort = () => { try {
+            child.kill();
+        }
+        catch { /* already exited */ } };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        child.stdout?.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+        child.stderr?.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+        child.on('error', () => finish(null));
+        child.on('close', (code) => finish(code));
+    });
+}
+/** Parse osv-scanner's `--format json` output into issues. */
+function parseOsvJson(text) {
+    try {
+        const parsed = JSON.parse(text);
+        const issues = [];
+        for (const result of parsed.results ?? []) {
+            for (const pkg of result.packages ?? []) {
+                const name = pkg.package?.name ?? 'unknown';
+                const version = pkg.package?.version;
+                for (const vuln of pkg.vulnerabilities ?? []) {
+                    issues.push({
+                        id: vuln.id,
+                        package: name,
+                        version,
+                        severity: osvSeverity(vuln),
+                        title: vuln.summary ?? vuln.id ?? 'vulnerability',
+                    });
+                }
+            }
+        }
+        return issues;
+    }
+    catch {
+        return [];
+    }
+}
+/** Map osv-scanner severity (a CVSS score object) to our severity vocabulary. */
+function osvSeverity(vuln) {
+    const score = Number.parseFloat(vuln.severity?.[0]?.score ?? '');
+    if (Number.isNaN(score))
+        return 'unknown';
+    if (score >= 9)
+        return 'critical';
+    if (score >= 7)
+        return 'high';
+    if (score >= 4)
+        return 'moderate';
+    return 'low';
+}
+/** Parse `npm audit --json` output into issues. */
+function parseNpmAuditJson(text) {
+    try {
+        const parsed = JSON.parse(text);
+        const issues = [];
+        for (const [key, vuln] of Object.entries(parsed.vulnerabilities ?? {})) {
+            const via = vuln.via ?? [];
+            const advisory = via.find((entry) => typeof entry === 'object' && entry !== null);
+            const title = advisory?.title ?? (typeof via[0] === 'string' ? via[0] : key);
+            issues.push({
+                id: typeof advisory?.url === 'string' ? advisory.url.split('/').pop() : undefined,
+                package: vuln.name ?? key,
+                version: vuln.range,
+                severity: npmSeverity(vuln.severity),
+                title,
+            });
+        }
+        return issues;
+    }
+    catch {
+        return [];
+    }
+}
+/** Normalize npm audit severity strings. */
+function npmSeverity(severity) {
+    if (severity === 'critical')
+        return 'critical';
+    if (severity === 'high')
+        return 'high';
+    if (severity === 'moderate')
+        return 'moderate';
+    if (severity === 'low')
+        return 'low';
+    return 'unknown';
+}
+/** Lockfile filenames that external scanners can operate on. */
+const LOCKFILES = ['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock'];
+function hasLockfile(dir) {
+    return LOCKFILES.some(name => existsSync(join(dir, name)));
+}
+/** osv-scanner adapter: detects the CLI, scans the directory. */
+export const osvScanner = {
+    source: 'osv-scanner',
+    label: 'OSV-Scanner',
+    async probe(dir, timeoutMs, signal) {
+        if (!hasLockfile(dir))
+            return false;
+        const result = await runCommand('osv-scanner', ['--version'], dir, timeoutMs, signal);
+        return result.code === 0 && result.stdout.length > 0;
+    },
+    async scan(dir, timeoutMs, signal) {
+        // `osv-scanner scan` (newer) falls back to the legacy flag-less form.
+        const attempts = [
+            ['scan', '--format', 'json', '--recursive', '.'],
+            ['--format', 'json', '--recursive', '.'],
+        ];
+        for (const args of attempts) {
+            const result = await runCommand('osv-scanner', args, dir, timeoutMs, signal);
+            if (result.code === 0 || result.stdout.trim() !== '') {
+                return parseOsvJson(result.stdout);
+            }
+        }
+        return [];
+    },
+};
+/** npm-audit adapter: detects a lockfile + the npm CLI, runs `npm audit`. */
+export const npmAuditScanner = {
+    source: 'npm-audit',
+    label: 'npm audit',
+    async probe(dir, timeoutMs, signal) {
+        if (!hasLockfile(dir))
+            return false;
+        const result = await runCommand('npm', ['--version'], dir, timeoutMs, signal);
+        return result.code === 0 && result.stdout.length > 0;
+    },
+    async scan(dir, timeoutMs, signal) {
+        const result = await runCommand('npm', ['audit', '--json'], dir, timeoutMs, signal);
+        if (result.stdout.trim() === '')
+            return [];
+        return parseNpmAuditJson(result.stdout);
+    },
+};
+/**
+ * Probe the external scanners in preference order and return the first that is
+ * available, or a `builtin` result (always available) when none is.
+ * @param dir - the local target directory to scan (external scanners need it).
+ * @param timeoutMs - per-CLI probe/scan timeout.
+ * @param signal - caller abort signal (the tool-call signal).
+ * @returns a result whose `source` names the effective scanner.
+ */
+export async function probeDependencyScanner(dir, timeoutMs, signal) {
+    for (const scanner of [osvScanner, npmAuditScanner]) {
+        try {
+            if (await scanner.probe(dir, timeoutMs, signal)) {
+                const issues = await scanner.scan(dir, timeoutMs, signal);
+                return { source: scanner.source, available: true, issues };
+            }
+        }
+        catch {
+            // Any probe/scan failure degrades to the next scanner (then builtin).
+        }
+    }
+    return { source: 'builtin', available: true, issues: [] };
+}

package/lib/vet/tool.js

@@ -95,6 +95,20 @@ const REPORT_SCHEMA = {
                 truncated: { type: 'boolean', required: true },
                 totalPackages: { type: 'integer', required: true },
                 unpinned: { type: 'array', required: true, items: { type: 'string' } },
+                source: { type: 'string', required: true, enum: ['builtin', 'osv-scanner', 'npm-audit'] },
+                vulnerabilities: {
+                    type: 'array', required: true,
+                    items: {
+                        type: 'object', additionalProperties: false,
+                        properties: {
+                            id: { type: 'string' },
+                            package: { type: 'string', required: true },
+                            version: { type: 'string' },
+                            severity: { type: 'string', required: true, enum: ['critical', 'high', 'moderate', 'low', 'unknown'] },
+                            title: { type: 'string', required: true },
+                        },
+                    },
+                },
             },
         },
         budget: {

package/pack/skills/dependency-audit/SKILL.md

@@ -4,7 +4,7 @@ description: '依赖供应链审计：pnpm/npm audit 输出与退出码解读、
 whenToUse: '用户要求审计或盘点项目依赖安全（漏洞、license、投毒、锁文件漂移）、解读 audit 报告、判断某个依赖能否引入，或写依赖审计结论时使用；单个依赖的普通升级与纯功能开发不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # 依赖审计（dependency-audit）

package/pack/skills/incident-response/SKILL.md

@@ -4,7 +4,7 @@ description: 'agent 环境安全事件响应：分类→控制蔓延→取证留
 whenToUse: 'agent 环境（DSH 会话、插件、MCP、CI）出现疑似安全事件——密钥泄露、被注入执行了未授权操作、依赖投毒、权限异常——需要响应、留证与复盘时使用；没有事件迹象的日常开发不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # 事件响应（incident-response）

package/pack/skills/prompt-injection-review/SKILL.md

@@ -4,7 +4,7 @@ description: '面向 agent 项目的提示注入面审查：AGENTS.md、技能
 whenToUse: '审查 agent 项目的上下文注入面（AGENTS.md/CLAUDE.md、.agents/skills、工具描述、MCP server 来源、web 抓取链路）、评估间接注入风险或对 agent 项目做安全评审时使用；与模型上下文无关的普通代码评审不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # 提示注入面审查（prompt-injection-review）

package/pack/skills/secret-scan/SKILL.md

@@ -4,7 +4,7 @@ description: '凭据/密钥暴露审计：gitleaks、trivy 全历史扫描命令
 whenToUse: '用户要求扫描或检查仓库的密钥泄露、排查某提交或某文件中的 token、给扫描告警定真伪、写脱敏泄露报告或规划密钥轮换时使用；纯功能开发与常规代码审查不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # 凭据扫描（secret-scan）

package/pack/skills/security-audit/SKILL.md

@@ -4,7 +4,7 @@ description: '仓库/软件安全审计总览：范围界定→资产清单→
 whenToUse: '用户要求对代码仓库或项目做安全审计、制定审计计划、划分审计阶段、汇总多类发现成报告，或不确定该从哪个专项技能开始时使用；单一主题任务（只查密钥、只查依赖、只评审一个 PR、只查注入面）直接加载对应专项技能，不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # 安全审计总览（security-audit）

package/pack/skills/supply-chain-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'PR/新依赖快速供应链评审：危险 install/postinstall 脚
 whenToUse: '评审含新依赖（package.json/锁文件变更）的 PR、审查某包的 install 脚本行为、判断疑似 typosquat 包或验证构建可复现性时使用；纯业务代码、与新增依赖无关的 PR 评审不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # 新增依赖快速评审（supply-chain-review）

package/pack/skills/threat-model/SKILL.md

@@ -4,7 +4,7 @@ description: '新功能/新系统的轻量威胁建模：固定对象→划定
 whenToUse: '用户要求对新功能/新系统做威胁建模、设计阶段安全评审、STRIDE 分析、攻击树分析，或要求把安全考虑前置到设计阶段时使用；纯实现细节讨论、与信任边界无关的改动不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # 威胁建模（threat-model）

package/pack/skills/vuln-intel/SKILL.md

@@ -4,7 +4,7 @@ description: '漏洞情报检索与判定：NVD/CISA-KEV/GHSA/OSV 四处权威
 whenToUse: '用户给出 CVE/GHSA 编号要求查详情与影响、判断漏洞是否被在野利用（KEV）、评估漏洞对当前项目/依赖的适用性或汇总漏洞情报简报时使用；没有具体编号的通用安全学习、与特定漏洞无关的讨论不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # 漏洞情报（vuln-intel）

package/pack/skills-en/dependency-audit/SKILL.md

@@ -4,7 +4,7 @@ description: 'Dependency supply-chain audit: reading pnpm/npm audit output and e
 whenToUse: 'Use when the user asks to audit or inventory project dependency security (vulnerabilities, licenses, poisoning, lockfile drift), to interpret an audit report, to judge whether a dependency may be introduced, or to write a dependency-audit conclusion. Upgrading a single dependency and plain feature development do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 # Dependency audit (dependency-audit)
 

package/pack/skills-en/incident-response/SKILL.md

@@ -4,7 +4,7 @@ description: 'Security incident response for agent environments: a staged flow o
 whenToUse: 'Use when an agent environment (DSH sessions, plugins, MCP, CI) shows a suspected security incident — secret leak, injected execution of unauthorized actions, dependency poisoning, permission anomalies — and it needs response, evidence, and a postmortem. Day-to-day development without incident indicators does not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # Incident response (incident-response)

package/pack/skills-en/prompt-injection-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'Injection-surface review for agent projects: a checklist covering
 whenToUse: 'Use when reviewing the context injection surfaces of an agent project (AGENTS.md/CLAUDE.md, .agents/skills, tool descriptions, MCP server sources, web-fetch chains), assessing indirect-injection risk, or doing a security review of an agent project. Ordinary code review unrelated to model context does not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 # Prompt-injection surface review (prompt-injection-review)
 

package/pack/skills-en/secret-scan/SKILL.md

@@ -4,7 +4,7 @@ description: 'Credential/secret exposure audit: gitleaks and trivy full-history
 whenToUse: 'Use when the user asks to scan or inspect a repository for secret leaks, to hunt tokens in a commit or file, to tier scan alerts as real or false, to write a redacted leak report, or to plan secret rotation. Plain feature development and ordinary code review do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 # Secret scanning (secret-scan)
 

package/pack/skills-en/security-audit/SKILL.md

@@ -4,7 +4,7 @@ description: 'Repository/software security audit overview: a staged flow of scop
 whenToUse: 'Use when the user asks for a security audit of a code repository or project, an audit plan, staged audit steps, a consolidated findings report, or is unsure which specialist skill to start with. Single-topic tasks (only secrets, only dependencies, only one PR, only injection surfaces) load the matching specialist skill directly and do not trigger this overview.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 # Security audit overview (security-audit)
 

package/pack/skills-en/supply-chain-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'Quick PR/new-dependency supply-chain review: dangerous install/pos
 whenToUse: 'Use when reviewing a PR that adds new dependencies (package.json/lockfile changes), inspecting a package install-script behavior, judging a suspected typosquat package, or verifying build reproducibility. Plain business-code PR reviews unrelated to new dependencies do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 # New-dependency quick review (supply-chain-review)
 

package/pack/skills-en/threat-model/SKILL.md

@@ -4,7 +4,7 @@ description: 'Lightweight threat modeling for new features/systems: fix the targ
 whenToUse: 'Use when the user asks for threat modeling of a new feature/system, design-stage security review, STRIDE analysis, attack-tree analysis, or wants security considered up front at design time. Pure implementation detail discussions and changes unrelated to trust boundaries do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # Threat modeling (threat-model)

package/pack/skills-en/vuln-intel/SKILL.md

@@ -4,7 +4,7 @@ description: 'Vulnerability intelligence lookup and triage: query commands for t
 whenToUse: 'Use when the user gives a CVE/GHSA id and asks for details and impact, whether a vulnerability is actively exploited (KEV), its applicability to the current project/dependencies, or a vulnerability intelligence brief. General security learning without a specific id, and discussions unrelated to a specific vulnerability, do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.4'
+  version: '2.2.3'
 ---
 
 # Vulnerability intelligence (vuln-intel)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@perrylink/dsh-skill-pack-security-provider",
-  "version": "2.1.4",
+  "version": "2.2.3",
   "description": "Provider plugin for dsh-skill-pack-security: registers the pack's skills/ (zh) or skills-en/ (en) edition on ctx.skills AND the plugin_vet supply-chain gate tool on ctx.tools (license/SBOM/commit-lock/malware scans + five-dimension risk card). Ships both skill editions embedded in pack/.",
   "type": "module",
   "main": "lib/index.js",
@@ -49,7 +49,7 @@
     ],
     "compatibility": {
       "dshVersions": [
-        "0.1.1-rc.2"
+        "0.1.2-alpha.3"
       ]
     },
     "capability": {
@@ -77,18 +77,18 @@
     "supply-chain"
   ],
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/dsh-skill-filesystem": ">=0.1.0-rc.8 <0.2.0",
     "@deepseek-ai/dsh-tools": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-skill-filesystem": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.1",
-    "@types/node": "^26.2.0",
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-llm": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-skill-filesystem": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-tools": "0.1.2-alpha.3",
+    "@deepseek-ai/schemastery": "^3.18.2",
+    "@types/node": "^26.4.0",
     "typescript": "^7.0.2"
   },
   "scripts": {