Weekly scan and audit orchestrator for Nx platform intelligence. Runs all 12 scan/audit commands plus the monthly digest via parallel subagents, then synthesizes a unified report with delta tracking. Use when user says "run scans", "weekly scan", "scan and audit", "run audits", "weekly report", "what's new this week", or any variation. Also use for "monthly scan" or "full audit".
Weekly scan and audit orchestrator for Nx platform intelligence. Runs all 12 scan/audit commands plus the monthly digest via parallel subagents, then synthesizes a unified report with delta tracking. Use when user says "run scans", "weekly scan", "scan and audit", "run audits", "weekly report", "what's new this week", or any variation. Also use for "monthly scan" or "full audit".
Run all Nx platform intelligence scans in parallel, then produce a unified
weekly report with delta tracking. Designed to be run at the start of the
week (or day) to give Jack a quick picture of what changed.
Arguments
$ARGUMENTS
No arguments: run all 13 scans (8 external + 1 CNW template validation +
3 internal audits + monthly digest) for the current week.
monthly only: skip scans, just run the monthly digest.
scans only: skip the monthly digest, just run scans/audits.
quick: skip slow scans (community, dependencies, supply-chain, api-surface,
capacity, project-health, customer-deps).
Only run web-research scans (competitors, frameworks, runtimes, ai-landscape)
plus cnw-templates (fast, critical).
internal: run only the 3 internal management audits (capacity, project-health,
customer-deps). These use Linear MCP — no GitHub cloning needed.
briefing: run internal audits + competitors + monthly digest. Produces
the full director-level monthly briefing.
This lets us compute deltas ("2 new critical deps since last week").
0c. Compute current week number and lookback window
date'+%Y-W%V'# Lookback window (default: 60 days, override with lookback=N argument)
LOOKBACK_DAYS=60
LOOKBACK_START=$(date -v-${LOOKBACK_DAYS}d '+%Y-%m-%d')
echo"Lookback window: $LOOKBACK_START to today"
The LOOKBACK_START date is passed to every subagent so they scan data
going back 60 days (not just the current calendar month). This ensures
coverage of events that happened in the prior month as well.
0d. GitHub auth (single 1Password approval)
Read the GitHub PAT once and stash it in a temp env file that subagents can
source. This is the one place all GitHub auth happens — every helper call
across orchestrator and subagents reads $GITHUB_TOKEN from this file, so
the user only sees one 1Password prompt for the whole run.
The op wrapper logs the request to Raycast on its own — just read the token:
SCAN_DATA_DIR="/tmp/scan-data-$(date +%s)"mkdir -p "$SCAN_DATA_DIR"/{releases,issues,api}
GITHUB_TOKEN=$(op read'op://Employee/API Keys/github_token') || {
echo"Failed to read GitHub token from 1Password"; exit 1
}
# Stash for subagents. Mode 600 so only this user can read it.umask 077
cat >"$SCAN_DATA_DIR/gh-env.sh" <<EOF
export GITHUB_TOKEN='$GITHUB_TOKEN'
EOFexport GITHUB_TOKEN
# Source helpers in this shell. Subagents do the same.source"$HOME/projects/dot-ai-config/dot_claude/skills/scan-and-audit/gh-helpers.sh"
If the op read fails, abort early — every downstream scan needs the token.
0e. Determine what to run
If lastMonthlyDigest < current month AND we're past the 25th of the
month, include the monthly digest.
Otherwise only include it if explicitly requested or if arguments say so.
All 8 scans run by default unless scoped by arguments.
Step 1: Clone Repos (if needed for audit commands)
Four commands need local repo access: audit-api-surface, audit-dependencies,
audit-supply-chain, and scan-community (for issue data, though community
mostly uses the GitHub REST API via the helpers).
If ocean clone fails (permissions, SSH keys), note it and continue with
nx-only scans. Never block on ocean access.
Store paths for subagents:
NX_REPO_PATH=$NX_TMP
OCEAN_REPO_PATH=$OCEAN_TMP (or empty if failed)
Step 1.5: Pre-fetch GitHub Data
Why: Otherwise each subagent would re-fetch the same data and we'd burn
the rate limit. Instead, run ALL GitHub API calls here in the orchestrator
(single shell, helpers already sourced, token already exported) and cache
results for subagents.
The output JSON files match the legacy gh --json shapes (the helpers in
gh-helpers.sh do the field rename), so existing jq filters in each scan
command keep working unchanged.
Release lists (21 repos)
Fetch releases for every repo any scan command needs. Helpers include body
so subagents don't need separate release-view calls.
# Open issues with metadata (community scan needs this)
gh_issue_list_with_meta nrwl/nx open 200 \
> "$SCAN_DATA_DIR/issues/nrwl-nx-open.json"# All issues — for resolution health + state verification
gh_issue_list_state nrwl/nx all 200 \
> "$SCAN_DATA_DIR/issues/nrwl-nx-all.json"# nx-cloud open issues
gh_issue_list_with_meta nrwl/nx-cloud open 100 \
> "$SCAN_DATA_DIR/issues/nrwl-nx-cloud-open.json" 2>/dev/null \
|| echo"[]" > "$SCAN_DATA_DIR/issues/nrwl-nx-cloud-open.json"
Total: ~30 sequential REST calls, single 1Password auth from step 0d,
~60–90 seconds. All output files match the legacy gh --json shape so the
existing jq filters in subagents work unchanged.
Step 2: Launch All Scans in Parallel
Launch each scan as a background Task subagent. Each subagent receives:
The command file content (its full instructions)
The repo path(s) to scan
The current month (YYYY-MM) for report file naming
The previous report path (if exists) for delta computation
$SCAN_DATA_DIR (so it can read the cached JSON + source gh-env.sh)
Every subagent prepends the following bootstrap to its shell work so the
helpers and token are available:
Group A — Repo-dependent audits (need cloned repos):
audit-dependencies — Audit dependency health across nx + ocean
Subagent instruction: "Run the dependency health audit. Scan both
$NX_REPO_PATH/packages/ and $OCEAN_REPO_PATH/ (if available).
Write report to .ai/para/areas/dependency-health/YYYY-MM.md."
audit-api-surface — Detect API vs docs drift
Subagent instruction: "Run the API surface audit on $NX_REPO_PATH.
Also check ocean's public npm packages if $OCEAN_REPO_PATH is available.
Write report to .ai/para/areas/api-surface-audit/YYYY-MM.md."
audit-supply-chain — Supply chain security review
Subagent instruction: "Run the supply chain audit. Check both @nx/*
and @nx-cloud/* scoped packages on npm. Use $NX_REPO_PATH for
workflow inspection. Write report to
.ai/para/areas/supply-chain-security/YYYY-MM.md."
scan-community — Community sentiment analysis
Subagent instruction: "Run the community sentiment scan. Cover both
nrwl/nx and nrwl/nx-cloud (if public) GitHub issues and discussions.
Write report to .ai/para/areas/community-sentiment/YYYY-MM.md."
Group A2 — CNW Template Validation (no repo access needed, CRITICAL PRIORITY):
cnw-templates — Create-Nx-Workspace template health check
Subagent instruction: "Validate all nrwl/ CNW (Create Nx Workspace) templates
by scaffolding workspaces and checking for npm audit warnings. This scan
MUST be reported first in the unified report — do not bury it.
IMPORTANT: Use --template=nrwl/*-template, NOT --preset=*-monorepo.
The --template flag uses the actual nrwl template repos which include
additional packages (e.g., @nx/module-federation in react/angular templates)
that --preset does not. Using --preset will produce falsely clean results.
Count vulnerabilities by severity: critical, high, moderate (medium), low
For each critical or high vulnerability, record: package name, severity,
vulnerability title, path (dependency chain), CVE if available, and
whether it's a direct or transitive dependency
Note which templates share the same vulnerability (likely same root dep)
Subagent instruction: "Run the AI landscape scan. In addition to the
standard coverage (MCP, coding tools, CI/CD, agentic patterns), also
research AI model security threats — specifically, new model
releases (Anthropic, OpenAI, Google, Meta, DeepSeek, xAI, open-weight
models, etc.) whose capabilities materially change the threat model
for orgs like ours. Flag:
Models advertised or benchmarked as strong at vulnerability
discovery / exploit generation in real codebases (e.g. a hypothetical
'Claude Mythos' release that finds CVEs easily). These shift the
offensive-security balance and matter for our supply-chain posture.
Models with notable jailbreak / alignment regressions that increase
misuse risk.
Agentic capabilities that enable autonomous recon, credential
harvesting, or repo exfiltration.
Prompt-injection / indirect-injection research that affects tools
we ship or embed (nx-mcp, Self-Healing CI, AI code review).
Surface findings under a dedicated 'AI Security Threats' section in
the AI landscape report. If any are High severity, include them in the
weekly TL;DR alongside CNW template and supply-chain findings."
Each writes to its own .ai/para/areas/ directory.
Group C — Internal management audits (Linear MCP, no repo access needed):
audit-capacity — Team capacity & sequencing risk analysis
Subagent instruction: "Run the team capacity audit. Use Linear MCP to
pull issue assignments, project leads, and due dates across all active
teams. Analyze the next 4-6 week window for conflicts. Write report
to .ai/para/areas/team-capacity/YYYY-MM.md."
Subagent instruction: "Run the project health audit. Use Linear MCP to
pull all In Progress projects, check milestone completion, identify
zombies (all milestones done, project still open), flag overdue target
dates and scope creep. Track revenue projects. Write report to
.ai/para/areas/project-health/YYYY-MM.md."
Subagent instruction: "Run the customer dependency audit. Use Linear MCP
to search for known strategic customers across all teams. Map customer
to feature dependencies, check engagement recency, assess DPE capacity.
Write report to .ai/para/areas/customer-deps/YYYY-MM.md."
Only runs if: current month > lastMonthlyDigest, OR explicitly requested.
Uses the full /nx-monthly-digest skill instructions.
Writes to .ai/para/areas/scan-audit/monthly-digests/.
Launching
Launch ALL scans simultaneously as background Task subagents. Use
run_in_background: true for all of them. Do NOT wait for one before
starting another.
For each subagent, provide:
The full command file content (read from dot_claude/commands/<name>.md)
Any repo paths
Current date/month
The LOOKBACK_START date (e.g., 2025-12-29 for a 60-day window)
The SCAN_DATA_DIR path (e.g., /tmp/scan-data-1772253563) for cached GitHub data
Path to previous report(s) within the lookback window (for delta comparison)
The two source lines from "Step 2" above (helpers + gh-env)
Step 3: Wait for All Scans to Complete
Wait for all background subagents to finish. As each completes, note:
Success or failure
Key finding counts (parse from the report it wrote)
Any errors or access issues
If a scan fails, log the error but don't retry — note it in the report.
Delta vs. previous report (new items, resolved items)
Action items
Step 5: Synthesize Unified Weekly Report
Write to .ai/para/areas/scan-audit/weekly/YYYY-WNN.md:
# Nx Platform Intelligence — Week {NN}, {Year}_Generated: {datetime}__Scans run: {list of scans that completed}__Scans failed: {list of any that failed, or "None"}_## TL;DR — What's New Since Last Week
{5-10 bullets, ranked by urgency. CNW template vulnerabilities ALWAYS
go first if any critical/high exist. Each bullet should be actionable
or informative enough to decide whether to dig deeper. Format:}
-**[AREA]** {finding}. {action needed or "FYI only"}.
Example:
-**[CNW Templates]** 2 high vulns in `angular-monorepo` preset via `postcss`. Resolve this week.
-**[AI Threat]** New frontier model claims SOTA on exploit-generation benchmarks — reassess supply-chain posture and secrets exposure.
-**[Security]** New CVE in `minimatch` affects nx@22.5.2. Already patched in 22.5.3. FYI only.
-**[Competitors]** Turborepo shipped remote caching v2 with content-addressable storage. Review implications for Nx Cloud positioning.
-**[Dependencies]**`chalk` hasn't published in 14 months. Now 🟠 Warning. We already migrated to picocolors — can remove.
## Dashboard
| Scan | Status | Findings | Delta |
|------|--------|----------|-------|
| **CNW Templates** | {status emoji} | {N critical, N high, N medium, N low} | {+/-N vs last week} |
| Dependencies | {status emoji} | {N critical, N warning} | {+/-N vs last week} |
| Supply Chain | {status emoji} | {status} | {change} |
| API Surface | {status emoji} | {N high, N medium} | {+/-N} |
| Community | {status emoji} | {N pain points} | {+/-N} |
| Competitors | {status emoji} | {N highlights} | {new items} |
| Frameworks | {status emoji} | {N compat risks} | {+/-N} |
| Runtimes | {status emoji} | {N action items} | {+/-N} |
| AI Landscape | {status emoji} | {N highlights} | {new items} |
| **Internal Audits** | | | |
| Team Capacity | {status emoji} | {N high-risk people} | {+/-N overdue} |
| Project Health | {status emoji} | {N zombies, N overdue} | {change} |
| Customer Deps | {status emoji} | {N concentration risks} | {churned/cooling} |
Status: ✅ = no action needed, ⚠️ = items to review, 🔴 = action required
## Priority Mismatch — Issues That May Need Bumping
Analyze `$SCAN_DATA_DIR/api/nrwl-nx-medium-priority-hot.json` and
`$SCAN_DATA_DIR/api/nrwl-nx-stale-hot.json` to surface:
### Medium Priority with High Engagement
Issues labeled `priority: medium` but with disproportionate community
engagement (reactions or comments). Thresholds:
-**Bump candidate**: 10+ total reactions OR 15+ comments
-**Strong bump candidate**: 20+ reactions OR 25+ comments
For each, list: issue number, title, reaction count, comment count,
age, and a one-line recommendation (bump to high? needs triage?).
### Stale High-Engagement Issues
Open issues older than 6 months with significant engagement (10+
reactions or 15+ comments) regardless of priority label. These are
long-standing pain points the community cares about. Filter
`nrwl-nx-stale-hot.json` by `createdAt` older than 180 days.
For each, list: issue number, title, age, reaction count, comment
count, current priority label, and whether it's been commented on
by maintainers recently.
If either list is empty, say so. Don't invent issues.
## Action Required
{Items from ANY scan that need immediate attention. Group by urgency.
If nothing, say "None this week."}
### This Week
{Must-do items}
### Soon (This Month)
{Should-do items}
### Watching
{Monitor, no action yet}
## Scan Summaries### CNW Template Health (REPORT FIRST)
{Summary of npm audit results across all 4 presets. Lead with critical/high
findings. List affected presets per vulnerability. Note if any preset failed
to create.}
**Critical (fix ASAP):** {list or "None"}
**High (resolve this week):** {list or "None"}
**Medium/Low (noted):** {list or "None"}
[Full report](.ai/para/areas/scan-audit/scans/cnw-templates/YYYY-MM.md)
### Dependencies
{2-3 sentence summary from dependency-health report. Link to full report.}
[Full report](.ai/para/areas/dependency-health/YYYY-MM.md)
### Supply Chain Security
{2-3 sentence summary.}
[Full report](.ai/para/areas/supply-chain-security/YYYY-MM.md)
### API Surface
{2-3 sentence summary.}
[Full report](.ai/para/areas/api-surface-audit/YYYY-MM.md)
### Community Sentiment
{2-3 sentence summary.}
[Full report](.ai/para/areas/community-sentiment/YYYY-MM.md)
### Competitors
{2-3 sentence summary.}
[Full report](.ai/para/areas/competitor-intel/YYYY-MM.md)
### Frameworks & Bundlers
{2-3 sentence summary.}
[Full report](.ai/para/areas/framework-ecosystem/YYYY-MM.md)
### Runtimes (Node.js, Bun, Deno)
{2-3 sentence summary.}
[Full report](.ai/para/areas/runtime-tracking/YYYY-MM.md)
### AI Dev Tools Landscape
{2-3 sentence summary.}
[Full report](.ai/para/areas/ai-dev-landscape/YYYY-MM.md)
### Team Capacity & Sequencing
{2-3 sentence summary: who's overloaded, what projects are at risk.}
[Full report](.ai/para/areas/team-capacity/YYYY-MM.md)
### Project Health
{2-3 sentence summary: zombie projects, overdue targets, scope creep.}
[Full report](.ai/para/areas/project-health/YYYY-MM.md)
### Customer Dependencies
{2-3 sentence summary: concentration risks, engagement changes, DPE load.}
[Full report](.ai/para/areas/customer-deps/YYYY-MM.md)
## Monthly Digest
{If digest ran this cycle, include TL;DR + link. Otherwise:
"Last digest: {month}. Next scheduled: {month}."}
Ensure .ai/para/areas/scan-audit/README.md exists and is current:
# Scan & Audit
Weekly intelligence scans across the Nx platform. Covers dependency health,
supply chain security, API drift, community sentiment, competitor activity,
framework ecosystem, runtime changes, and AI tool landscape.
## How to Run
/scan-and-audit # Full weekly scan (all 9)
/scan-and-audit quick # Web-research scans only (fast, ~5 min)
/scan-and-audit digest # Monthly digest only
/scan-and-audit competitors frameworks # Specific scans
# Remove cloned repos and cached GitHub data (token file lives inside SCAN_DATA_DIR)rm -rf "$NX_TMP""$OCEAN_TMP""$SCAN_DATA_DIR" 2>/dev/null
unset GITHUB_TOKEN
Step 9: Present Results
IMPORTANT: Present CNW Template Health findings FIRST, before the TL;DR
and Dashboard. If there are any critical or high vulnerabilities, lead with
those — they must not be buried in the full report. Then print the TL;DR
section and Dashboard table.
Tell them where the full report is saved. Offer to:
Dive deeper into any specific scan
Re-run a specific scan with different scope
Create Linear issues for action items
Important Notes
Parallelism: Launch ALL subagents at once. The skill should take
~10-15 minutes total (bounded by the slowest scan), not 60+ minutes
running sequentially.
Idempotent: Running twice in the same week updates the existing
weekly report rather than creating a duplicate.
Graceful degradation: If ocean can't be cloned, if npm is slow, if
the GitHub API rate-limits — note it and continue. Never fail the whole
run because one scan had issues.
Delta focus: The weekly report should emphasize WHAT CHANGED since
last run. The individual reports have the full picture.
No invention: Every finding must trace to a source. Don't speculate
about risks that aren't evidenced by the data.
LIVE DATA OVER TRAINING DATA: This is the #1 quality rule. For
every factual claim (version numbers, release status, issue state,
EOL dates, download counts), verify against a live source BEFORE
writing it. Training data is stale by definition. Use:
npm view <pkg> version for package versions
$SCAN_DATA_DIR/releases/*.json for release data (pre-fetched)
$SCAN_DATA_DIR/issues/*.json for issue data (pre-fetched)
WebFetch for changelogs, blogs, and EOL dates
npm view <pkg> time.modified for last-publish dates
If a live API is unavailable, explicitly mark the claim as
"unverified (from training data)" in the report.
Verify issue state: Before listing any GitHub issue as an active
pain point or action item, verify it is still OPEN using
gh_issue_view nrwl/nx <N>. Closed issues should be noted as
resolved, not listed as current problems. This applies to ALL scans
that reference GitHub issues (community, dependencies, supply-chain).
Thoroughness over speed: Use many tokens and subagent passes. It's
better to spend 15 minutes and catch everything than to skim in 5
minutes and miss a CVE or a competitor launch.
