场景定位
把公开包 advisory 转成安全的仓库审计计划。 本页把官方 use case 的章节、工具、起步提示词和检查点整理成中文执行流程，便于直接对照落地。
- 难度
- 高级
- 时间跨度
- 约 30-60 分钟
适合用于
- 需要把「把公开包 advisory 转成安全的仓库审计计划。」做成可复用流程的团队，且来源分散在 GitHub 等工具中
- 希望 ChatGPT 或 Codex 保留来源、检查点和可审阅输出的使用者
- 需要把「审计依赖事件」从一次性对话变成可复查工作流的场景
Skills & Plugins
相关工具
Starter Prompt
起步提示词
Help me audit this repository for exposure to this public package advisory: [advisory URL].
Stay read-only unless I explicitly approve a remediation step.
First, summarize:
- affected packages and version ranges
- authoritative sources versus broader reports
- what evidence would prove exposure in this repo
- what evidence would rule it out
Then inspect:
- package manifests and lock files
- CI workflows and permissions
- install, build, and postinstall scripts
- vendored artifacts, containers, or generated bundles if relevant
- cache or token exposure paths if the advisory involves CI or publishing
Return:
- evidence status: confirmed exposure, needs verification, or ruled out
- severity and blast-radius notes
- file references for every repo-specific claim
- caveats and recommended next steps
Do not install packages, run lifecycle scripts, build the project, execute untrusted code, rotate credentials, or clean up files unless I explicitly approve that step.从 a safe audit 计划 开始
这一节对应官方流程中的「Start with a safe audit plan」。落地时围绕「审计依赖事件」把目标、输入、执行步骤和验证证据保持在同一条工作流里。
操作要点：围绕「Start with a safe audit plan」推进「审计依赖事件」时，保持目标、输入、执行步骤和验证结果一致。
操作要点：把已确认的上下文转成「审计依赖事件」所需的可审阅草稿或交付物，并关注 Codex 等相关来源或工具，并保留后续修改入口。
保持 the first pass read-only
这一节对应官方流程中的「Keep the first pass read-only」。落地时围绕「审计依赖事件」把目标、输入、执行步骤和验证证据保持在同一条工作流里。
操作要点：先把本节需要的来源材料、权限和上下文补齐，并关注 Codex 等相关来源或工具；缺失内容要明确标记，不要让 ChatGPT 或 Codex 隐式猜测。
Report evidence status separately from severity
这一节对应官方流程中的「Report evidence status separately from severity」。落地时围绕「审计依赖事件」把目标、输入、执行步骤和验证证据保持在同一条工作流里。
操作要点：围绕「Report evidence status separately from severity」推进「审计依赖事件」时，保持目标、输入、执行步骤和验证结果一致。
操作要点：把已确认的上下文转成「审计依赖事件」所需的可审阅草稿或交付物，并关注 Codex 等相关来源或工具，并保留后续修改入口。
Prompt Library
建议提示词
先界定范围
For Audit dependency incidents, first inspect the available sources and propose the smallest useful scope. Name the inputs, outputs, validation steps, permissions, and anything that needs approval before action.交付前复核
Review the result for Audit dependency incidents. Check source coverage, assumptions, unresolved questions, and the evidence that proves the output is ready to use.