メニュー
Look up every published package that corresponds to a repository, across all registries, and record download counts, dependent counts, latest version, and registry URL. Use to populate the Packages tab.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Identify the real maintainers of a repository and the best way to contact them about a security issue. Distinguishes active leads from occasional contributors and bots, using commit history, issue activity, and registry ownership. Use when preparing a disclosure and needing to know who to reach.
Index dependencies reported by git-pkgs for the repository's manifest and lockfile files (package.json, Gemfile, go.mod, requirements.txt, etc.) and record each one with its manifest path, ecosystem, and requirement string. Use to populate the Dependencies tab.
Check whether known sinks in this application's dependencies are reachable from its own trust boundaries. Scrutineer already holds findings against the libraries this app uses; this skill traces each one from the app's entry points to the library call and reports the ones an attacker can reach. Use on applications (Gemfile.lock / package-lock.json present), not on libraries.
Generate a CycloneDX Software Bill of Materials for the repository. Use when you want a standard-format inventory of components for downstream tooling, compliance, or archival. Stored verbatim on the scan.
Fetch the published security advisories that affect any package produced by this repository. Use to populate the Advisories tab with existing GHSA and CVE records so analysts can see what is already public before triaging new findings.
For each published package of this repository, fetch the top runtime dependents so later exposure-analysis skills have a ranked shortlist to work against. Use after the packages skill has populated which packages exist.
| name | packages |
| description | Look up every published package that corresponds to a repository, across all registries, and record download counts, dependent counts, latest version, and registry URL. Use to populate the Packages tab. |
| license | MIT |
| compatibility | Needs network access to packages.ecosyste.ms. |
| allowed-tools | Read,Write,WebFetch,Grep,Glob,LS |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"packages","scrutineer.requires_remote":true} |
One repository can ship multiple packages across multiple ecosystems. Ask packages.ecosyste.ms for all of them and record the headline stats.
./context.json — has repository.url./report.json — write the packages array here./schema.json — output shape./context.json and extract repository.url.https://packages.ecosyste.ms/api/v1/packages/lookup?repository_url={URL-ENCODED_URL}. The response is a JSON array, one object per published package.report.json under packages mapping these fields:
name from upstream nameecosystem from upstream ecosystem (e.g. rubygems, npm, pypi)purl from upstream purllicenses from upstream licenses (string, comma-joined if upstream gives a list)latest_version from upstream latest_release_number or latest_versionversions_count from upstream versions_countdownloads from upstream downloadsdependent_packages from upstream dependent_packages_countdependent_repos from upstream dependent_repos_countregistry_url from upstream registry_url or the registry's canonical package pagelatest_release_at from upstream latest_release_published_at (RFC3339)dependent_packages_url from upstream dependent_packages_urlmetadata — the whole upstream object for this package, verbatimIf there are no packages (lookup returns []), write {"packages": []}. That is a valid result, not an error.