---
name: vuln-check
description: Use when asked to check for security vulnerabilities, or when the /vuln-check command runs — scan the project for known vulnerable dependencies and security anti-patterns.
---

# Vulnerability Check

Check the current project for security vulnerabilities: dependency advisories and code-level security anti-patterns.

## Procedure

1. **依赖审计**: inspect the lockfile/manifest (package-lock.json / pnpm-lock.yaml / requirements.txt…) for known-vulnerable versions. Use the local toolchain (npm audit / pnpm audit when available and network permits) or compare against known advisory data.
2. **代码检查**: scan for security anti-patterns with file/line evidence:
   - shell command injection (string interpolation into exec/spawn with shell:true)
   - path traversal (user input joined into paths without normalization)
   - secrets committed (API keys, tokens, private keys in the tree); report only the file path, line, and secret type, never the value or source excerpt
   - unsafe eval / dynamic import of user input
   - missing input validation at trust boundaries
3. Report findings ordered by severity, each with: location, CVE/advisory id when applicable, impact, and remediation (upgrade to which version, or the code change needed).
4. State explicitly when the project is clean in a category.

## Constraints

- Never disclose a complete secret; diagnostics may report only whether it is set.
- Distinguish "verified vulnerable" from "needs verification" — never overstate.
- Do not modify code during the check.