メニュー
Fetch the published security advisories that affect any package produced by this repository. Use to populate the Advisories tab with existing GHSA and CVE records so analysts can see what is already public before triaging new findings.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | advisories |
| description | Fetch the published security advisories that affect any package produced by this repository. Use to populate the Advisories tab with existing GHSA and CVE records so analysts can see what is already public before triaging new findings. |
| license | MIT |
| compatibility | Needs network access to advisories.ecosyste.ms. |
| allowed-tools | Read,Write,WebFetch,Grep,Glob,LS |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"advisories","scrutineer.requires_remote":true} |
./context.json — has repository.url./report.json — write the advisories array here./schema.json — output shape./context.json and extract repository.url.https://advisories.ecosyste.ms/api/v1/advisories?repository_url={URL-ENCODED_URL}. Follow pagination (Link: <...>; rel="next") if present.report.json under advisories:
uuid from upstream uuidurl from upstream url (or the first reference if url is empty)title from upstream titledescription from upstream descriptionseverity from upstream severity (upper-case, e.g. CRITICAL, HIGH, MEDIUM, LOW)cvss_score from upstream cvss_score (number; omit if absent)classification from upstream classification (e.g. CWE id)packages — comma-joined list of affected package names upstream lists under packages or package_namespublished_at and withdrawn_at as RFC3339 strings if upstream has themReturn {"advisories": []} if upstream has nothing — valid result.
Identify the real maintainers of a repository and the best way to contact them about a security issue. Distinguishes active leads from occasional contributors and bots, using commit history, issue activity, and registry ownership. Use when preparing a disclosure and needing to know who to reach.
Index dependencies reported by git-pkgs for the repository's manifest and lockfile files (package.json, Gemfile, go.mod, requirements.txt, etc.) and record each one with its manifest path, ecosystem, and requirement string. Use to populate the Dependencies tab.
Check whether known sinks in this application's dependencies are reachable from its own trust boundaries. Scrutineer already holds findings against the libraries this app uses; this skill traces each one from the app's entry points to the library call and reports the ones an attacker can reach. Use on applications (Gemfile.lock / package-lock.json present), not on libraries.
Generate a CycloneDX Software Bill of Materials for the repository. Use when you want a standard-format inventory of components for downstream tooling, compliance, or archival. Stored verbatim on the scan.
For each published package of this repository, fetch the top runtime dependents so later exposure-analysis skills have a ranked shortlist to work against. Use after the packages skill has populated which packages exist.
For one (finding, dependent) pair, decide whether the dependent's published code actually reaches the upstream library finding. Emit one CSAF 2.0 product_status verdict so scrutineer can record affected vs not_affected and stamp the right VEX justification.