zhaolei
6f402ffcee
- 后端: coworker 智能体框架, WS API, 文件上传, 附件处理 - 前端: Open WebUI, 文件全量走 upload API (含 MD/TXT/JSON 等文本类) - 技能: md-to-office (pandoc + wkhtmltopdf) - 修复: 上传文件路径丢失, Agent 搜索浪费, 输出文件跑到 uploads/ - 打包: PyInstaller one-dir, 预打包 pandoc/wkhtmltopdf/chromium
1.8 KiB
1.8 KiB
name, description
| name | description |
|---|---|
| iac-scan | Scan Terraform/IaC with trivy config and fix what matters in code |
Scan the repo's infrastructure-as-code and turn findings into minimal, safe Terraform changes.
- Pick the scanner (in this order — do NOT skip the scan if none is present):
trivy config . --format json -o /tmp/iac.json(also covers Dockerfiles/k8s)checkov -d . -o json > /tmp/iac.jsonif the repo already uses it- Neither installed: ask for trivy with
request_tool("trivy", …). If the user declines, review the Terraform by hand against the exposure checklist in step 2 and say in your report that the scan was manual. Do not suggest tfsec — it is deprecated;trivy configis its successor.
- Triage by real exposure, reading the surrounding Terraform for each finding:
- Internet-reachable (0.0.0.0/0 ingress, public buckets/ALBs) first.
- Then identity blast radius (wildcard IAM, broad assume-role trust).
- Then encryption/logging hygiene. Mark deliberate-looking configuration (a public website bucket, a bastion SG) as "intentional?" and ask rather than auto-fix.
- Fix in the module where the resource is DEFINED (follow module sources), matching the repo's Terraform style — variables, locals, and tags the way the codebase already does them.
- Validate every change:
terraform fmton touched files, thenterraform init -backend=false && terraform validatewhen possible. Includeterraform planoutput in the PR when the user can run it — NEVER runterraform apply. - Deliver: exposure-ranked findings table (resource · issue · verdict · action), the
fix branch/PR, and any "intentional?" items awaiting a human decision. Offer a
pinned scanner config (e.g.
.trivyignorewith justifications) only for findings the team explicitly accepts.