القائمة
Run git-pkgs list and sbom against the repository and emit one envelope with per-section status.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/alpha-omega-security/scrutineer --skill dependenciesيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Re-run a finding's reproduction against current HEAD, test its attack tree, grade five fixed evidence criteria, and account for every matched design control.
Judge whether a validated finding can affect a real release build, and record the attacker position, preconditions, impact, counterevidence, and facts that could change that conclusion. Finding-scoped and read-only.
Draft the disclosure content for a finding in GitHub Security Advisory shape. Produces a title, markdown description, affected package block, CVSS vector, CWE list, references, and a suggested-recipients list from CODEOWNERS or git history, then writes them back to the finding so the analyst can paste them into the GHSA form (or POST to GitHub's repository-advisories REST endpoint) rather than composing from scratch.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | dependencies |
| description | Run git-pkgs list and sbom against the repository and emit one envelope with per-section status. |
| license | MIT |
| compatibility | Requires `git-pkgs` (https://github.com/git-pkgs/git-pkgs) and `python3` on PATH. |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"dependencies","scrutineer.paths":["**"],"scrutineer.ignore_paths":["**/node_modules/**","**/dist/**","**/generated/**","**/__generated__/**","**/*.min.js","**/*.min.css"]} |
Run the two per-repository git-pkgs analyses after one git-pkgs init and assemble the results into a versioned envelope. analyses.inventory is the manifest occurrence list from git-pkgs list; analyses.sbom is the CycloneDX document from git-pkgs sbom --skip-enrichment. Each section has its own status so a failure in one does not discard the other. Per-package registry lookups (licences, vulnerabilities, latest-version, deprecation) are not run here; scrutineer performs those once per package outside the scan. Scrutineer's worker resolves Maven requirements from local pom.xml files with git-pkgs/pom, fills requirement_resolution, and marks unresolved placeholders with requirement_unresolved.
./src — the cloned repository./scripts/index.sh — the wrapper script./report.json — write the final report here./schema.json — output shapescripts/index.sh — runs git-pkgs init inside ./src, then list and sbom --skip-enrichment, capturing stdout, stderr, and exit code per command, and writes the assembled envelope to stdout.Run the script and capture its stdout as the report:
bash scripts/index.sh > ./report.json
If the script exits non-zero, read its stderr, then write {"schema_version": 1, "analyses": {}, "error": "..."} to ./report.json so the caller sees why nothing was collected.
The wrapper already emits the exact schema the parser expects, including per-section status: "error" for a failed command. Do not post-process, merge sections, or hand-author dependency rows. Do not inspect manifests yourself or infer dependencies from files that git-pkgs did not report. An empty analyses.inventory.result means git-pkgs found no manifests; write that report and stop.