原文核对：2026-10-13 · 中文正文 · 英文提示词与演示
场景定位
把公开包或供应链公告转成只读审计，检查 manifest、lockfile、CI 和脚本，不执行不可信代码。
- 难度
- 高级
- 时间跨度
- 1 小时
适合用于
- 响应公开依赖或供应链公告的工程安全团队。
- 修改依赖前需检查锁文件、脚本、CI 权限和缓存的维护者。
- 需在不安装包、不运行不可信代码前提下取证的审查。
相关工具
检查仓库文件、PR、工作流和安全相关历史。
GitHub ↗起步提示词
英文原文 · 可复制后按实际材料修改
Help me audit this repository for exposure to this public package advisory: [advisory URL].
Stay read-only unless I explicitly approve a remediation step.
First, summarize:
- affected packages and version ranges
- authoritative sources versus broader reports
- what evidence would prove exposure in this repo
- what evidence would rule it out
Then inspect:
- package manifests and lock files
- CI workflows and permissions
- install, build, and postinstall scripts
- vendored artifacts, containers, or generated bundles if relevant
- cache or token exposure paths if the advisory involves CI or publishing
Return:
- evidence status: confirmed exposure, needs verification, or ruled out
- severity and blast-radius notes
- file references for every repo-specific claim
- caveats and recommended next steps
Do not install packages, run lifecycle scripts, build the project, execute untrusted code, rotate credentials, or clean up files unless I explicitly approve that step.先制定安全审计计划
快速发展的供应链事件中，先明确变化、受影响包或工作流，以及仓库中可证明暴露的证据。
安装、构建、测试或运行之前，先生成审慎的只读清单。
首轮保持只读
- 提供公开公告、事件报告或受影响包列表。
- 区分权威来源与一般评论。
- 定义证明或排除暴露的证据。
- 检查 manifest、lockfile、CI、脚本和相关文件。
- 按证据状态、严重程度和建议行动分组。
了解公告影响前不要运行 install、build、test、import 或 lifecycle 命令；搜索锁文件与工作流即可，不必执行不可信代码。
区分证据与严重程度
同时展示潜在严重性与证据强度：
Codex已确认暴露：生产依赖路径的锁文件包含受影响版本。
待验证：某 CI 任务有发布权限，但似乎没有直接安装该包。
已排除：包名只在文档出现，不在 manifest 或锁文件中。
下一步：破坏性操作前先审阅依赖更新和 token 轮换方案。
只读审计完成后再单独准备修复 PR、修改 CI 权限或撰写后续事件说明。
官方提示词
英文原文 · 可复制后按实际材料修改
Turn the confirmed findings from this audit into a remediation plan.
For each finding, include:
- proposed change
- files or settings to update
- test or verification step
- rollback plan
- whether I need to rotate a credential or review an external system
Do not make changes yet. Keep any command that could execute untrusted code out of the plan unless you explain why it is safe.展开英文原文对照
Use Codex to turn a public package or supply chain advisory into a read-only audit, then inspect manifests, lock files, CI workflows, and scripts without running untrusted code.
Start with a safe audit plan
When a dependency or supply chain incident moves quickly, the first useful output isn’t a rushed patch. It’s a clear audit plan: what changed, which packages or workflows might be affected, and what evidence would prove exposure in your repo.
Use Codex to turn the advisory into a conservative, read-only checklist before installing, building, testing, or running anything.
Keep the first pass read-only
- Give Codex the public advisory, incident report, or affected package list.
- Ask it to separate authoritative sources from broader commentary.
- Have it define evidence that would prove or rule out exposure.
- Let it inspect manifests, lock files, CI workflows, scripts, and relevant repo files.
- Ask for findings grouped by evidence status, severity, and recommended next step.
For package incidents, avoid running install, build, test, import, or lifecycle commands until you know what the advisory affects. Codex can search lock files and workflows without executing untrusted code.
Report evidence status separately from severity
A useful audit result should show both how bad a finding would be and how strong the evidence is:
CodexConfirmed exposure: the lockfile contains an affected package version in a production dependency path.
Needs verification: one CI job has publish permissions, but the workflow does not appear to install the affected package directly.
Ruled out: the package name appears in docs only and is not present in manifests or lock files.
Next step: review the proposed dependency update and token rotation plan before any destructive action.
Once the read-only pass is complete, you can ask Codex to prepare a remediation PR, update CI permissions, or write a follow-up incident note. Keep those actions separate from the initial audit.
官方提示词
英文原文 · 可复制后按实际材料修改
Turn the confirmed findings from this audit into a remediation plan.
For each finding, include:
- proposed change
- files or settings to update
- test or verification step
- rollback plan
- whether I need to rotate a credential or review an external system
Do not make changes yet. Keep any command that could execute untrusted code out of the plan unless you explain why it is safe.