| name | vuln-scan |
| description | Analyze dependency or ecosystem risk and produce remediation and advisory packets. |
Vulnerability Scan
Review one dependency surface or project scope and produce a bounded security
packet. This skill is for operator-facing risk analysis, remediation planning,
and advisory drafting. It is not a license to run arbitrary destructive scans.
Keep the output practical: what is affected, how serious it is, what to do
next, and whether a public advisory is justified.
Quality Profile
- Purpose: turn one bounded dependency or ecosystem risk surface into a
remediation and advisory decision.
- Audience: maintainers, operators, and affected users who need clear risk and
next steps.
- Artifact contract: inventory, advisories, remediation plan, operator summary,
advisory draft, maintainer summary, and disclosure checklist as appropriate.
- Evidence bar: cite package data, versions, advisories, scan output, commits,
or public references. Separate confirmed exposure from possible risk.
- Voice bar: calm security writing. No alarmism, no vague severity claims, and
no public advisory language unless disclosure evidence supports it.
- Strategic bar: help the operator decide whether to patch, disclose, monitor,
escalate, or stop.
- Stop conditions: return
needs_more_evidence, needs_human, or
do_not_publish_advisory when exposure, affected versions, or disclosure
posture cannot be verified.
Output
Scan runner:
dependency_inventory: affected components and versions.advisories: findings with severity, exposure, and evidence.remediation_plan: concrete next actions.operator_summary: concise decision-ready summary.
Advisory runner:
advisory_draft: public or maintainer-facing advisory text.maintainer_summary: concise summary for repo owners.disclosure_checklist: what to verify before public release.
Inputs
target (required): repo, lockfile, package set, or ecosystem slice.objective (optional): what the operator wants from this scan.scan_context (optional): known packages, incidents, or prior findings.advisories (optional): structured findings from the scan runner.remediation_plan (optional): structured remediation plan for the advisory pass.
