メニュー
For each published package of this repository, fetch the top runtime dependents so later exposure-analysis skills have a ranked shortlist to work against. Use after the packages skill has populated which packages exist.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/alexandre-daubois/scrutineer --skill dependentsコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Identify the real maintainers of a repository and the best way to contact them about a security issue. Distinguishes active leads from occasional contributors and bots, using commit history, issue activity, and registry ownership. Use when preparing a disclosure and needing to know who to reach.
Index dependencies reported by git-pkgs for the repository's manifest and lockfile files (package.json, Gemfile, go.mod, requirements.txt, etc.) and record each one with its manifest path, ecosystem, and requirement string. Use to populate the Dependencies tab.
Check whether known sinks in this application's dependencies are reachable from its own trust boundaries. Scrutineer already holds findings against the libraries this app uses; this skill traces each one from the app's entry points to the library call and reports the ones an attacker can reach. Use on applications (Gemfile.lock / package-lock.json present), not on libraries.
| name | dependents |
| description | For each published package of this repository, fetch the top runtime dependents so later exposure-analysis skills have a ranked shortlist to work against. Use after the packages skill has populated which packages exist. |
| license | MIT |
| compatibility | Needs network access to packages.ecosyste.ms. |
| allowed-tools | Read,Write,WebFetch,Grep,Glob,LS |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"dependents","scrutineer.requires_remote":true} |
./context.json — has repository.url./report.json — write the combined dependents array here./schema.json — output shape./context.json and extract repository.url.https://packages.ecosyste.ms/api/v1/packages/lookup?repository_url={URL-ENCODED_URL}. Each entry has a dependent_packages_url.dependent_packages_url, fetch up to the first 30 results, ranked by dependent_repos_count or downloads descending.report.json's dependents array:
name from upstream nameecosystem from upstream ecosystempurl from upstream purlrepository_url from upstream repository_url or repo_metadata.html_urldownloads from upstream downloadsdependent_repos from upstream dependent_repos_countregistry_url from upstream registry_urllatest_version from upstream latest_release_numberDe-duplicate by purl when a dependent appears under more than one of this repo's packages.
If there are no packages or no dependents, write {"dependents": []}. Valid result.