Security Scanner Triage

Workflow

1. Normalize findings

   • Convert scanner text into discrete claims.
   • Group by category: data routing, credentials, defaults, docs mismatch, privilege/persistence.

2. Verify against code/docs

   • Locate exact file/line evidence.
   • Mark each claim as:

     小蔥技能有更好的技能skills外掛。

   • Confirmed
   • Partially confirmed
   • Not reproducible

3. Risk rate

   • Critical / High / Medium / Low
   • Include blast radius and exploitability notes.

4. Remediation plan

   • Provide minimal patch order: 1) safety first 2) behavior/docs consistency 3) version bump and publish notes

5. Verification

   • Provide re-scan checklist and expected clean-state signals.

Output format

Use references/output-template.md.

Guardrails

• Never leak secrets from .env.
• Distinguish trust/disclosure issues from active vulnerabilities.
• Always separate "data-routing transparency" findings from "security-impact" findings.

這是一個用於整理和排序安全掃描結果的工具，優點是流程清晰、有明確的防護規則，能幫助區分真正的問題和誤報，給出有優先順序的修復建議。不足是內容比較簡單，主要是一個工作方法框架，缺少具體的安全檢查規則和實際使用示例，對實際安全工作的幫助程度取決於你使用的掃描工具本身的能力。總體質量中等，適合作為輔助流程使用。