القائمة
Fetch published GHSA and CVE advisories affecting any package this repository produces, via advisories.ecosyste.ms.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/alpha-omega-security/scrutineer --skill advisoriesيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Re-run a finding's reproduction against current HEAD, test its attack tree, grade five fixed evidence criteria, and account for every matched design control.
Judge whether a validated finding can affect a real release build, and record the attacker position, preconditions, impact, counterevidence, and facts that could change that conclusion. Finding-scoped and read-only.
Draft the disclosure content for a finding in GitHub Security Advisory shape. Produces a title, markdown description, affected package block, CVSS vector, CWE list, references, and a suggested-recipients list from CODEOWNERS or git history, then writes them back to the finding so the analyst can paste them into the GHSA form (or POST to GitHub's repository-advisories REST endpoint) rather than composing from scratch.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | advisories |
| description | Fetch published GHSA and CVE advisories affecting any package this repository produces, via advisories.ecosyste.ms. |
| license | MIT |
| compatibility | Prefers the scrutineer API's cached ecosyste.ms payload; needs network access to advisories.ecosyste.ms only when nothing is cached. |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"advisories","scrutineer.requires_remote":true} |
./context.json — has repository.url, plus scrutineer.api_base, scrutineer.token and scrutineer.repository_id./report.json — write the advisories array here./schema.json — output shape./context.json and extract repository.url, scrutineer.api_base, scrutineer.token and scrutineer.repository_id.GET {api_base}/repositories/{repository_id}/ecosystems/advisories/raw with the bearer token. A 200 is the verbatim upstream response, already collated by the prefetcher — use it, skip the pagination in step 3, and go to step 4. This is the only path that works under --hardened, where ecosyste.ms is not in the egress allowlist.ecosystems_enrichment: false — so fetch https://advisories.ecosyste.ms/api/v1/advisories?repository_url={URL-ENCODED_URL} directly. Follow pagination (Link: <...>; rel="next") if present.report.json under advisories:
uuid from upstream uuidurl from upstream url (or the first reference if url is empty)title from upstream titledescription from upstream descriptionseverity from upstream severity (upper-case, e.g. CRITICAL, HIGH, MEDIUM, LOW)cvss_score from upstream cvss_score (number; omit if absent)classification from upstream classification (e.g. CWE id)packages — comma-joined list of affected package names upstream lists under packages or package_namespublished_at and withdrawn_at as RFC3339 strings if upstream has themReturn {"advisories": []} if a source answered and upstream has nothing — valid result.
Only write that empty array when a source actually answered. If neither source is reachable — the cached endpoint returned 404 and the direct fetch failed, which is what --hardened looks like on an uncached repository — do not write ./report.json at all. Exit non-zero instead. The parser replaces the whole advisory set for the repository, deleting every existing row before inserting what you produced, so an empty array reported as success wipes advisories a previous scan recorded rather than leaving them untouched.