메뉴
Produce a structured plain-language overview of what a repository does, who maintains it, its activity level, and the shape of its codebase. Use when you want a quick orientation before deeper analysis.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Identify the real maintainers of a repository and the best way to contact them about a security issue. Distinguishes active leads from occasional contributors and bots, using commit history, issue activity, and registry ownership. Use when preparing a disclosure and needing to know who to reach.
Index dependencies reported by git-pkgs for the repository's manifest and lockfile files (package.json, Gemfile, go.mod, requirements.txt, etc.) and record each one with its manifest path, ecosystem, and requirement string. Use to populate the Dependencies tab.
Check whether known sinks in this application's dependencies are reachable from its own trust boundaries. Scrutineer already holds findings against the libraries this app uses; this skill traces each one from the app's entry points to the library call and reports the ones an attacker can reach. Use on applications (Gemfile.lock / package-lock.json present), not on libraries.
Generate a CycloneDX Software Bill of Materials for the repository. Use when you want a standard-format inventory of components for downstream tooling, compliance, or archival. Stored verbatim on the scan.
Fetch the published security advisories that affect any package produced by this repository. Use to populate the Advisories tab with existing GHSA and CVE records so analysts can see what is already public before triaging new findings.
For each published package of this repository, fetch the top runtime dependents so later exposure-analysis skills have a ranked shortlist to work against. Use after the packages skill has populated which packages exist.
| name | repo-overview |
| description | Produce a structured plain-language overview of what a repository does, who maintains it, its activity level, and the shape of its codebase. Use when you want a quick orientation before deeper analysis. |
| license | MIT |
| compatibility | Requires the `brief` CLI (https://github.com/ecosyste-ms/brief) on PATH. |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"repo_overview"} |
Produce an overview of the repository cloned at ./src by invoking the brief tool and writing its output verbatim as the report. brief already does the reading, summarising, and structured-output work; this skill is the thin harness around it.
./src — the cloned repository./context.json — read scrutineer.scan_subpath; other fields are unused./report.json — write the final report hereIf ./context.json has scrutineer.scan_subpath set, run brief against that sub-folder instead of the repo root:
brief --json ./src/$(jq -r '.scrutineer.scan_subpath // ""' ./context.json | sed 's:^/*::') > ./report.json
If scan_subpath points at a directory that does not exist under ./src, write {"error": "scan_subpath not found: <path>"} and stop. For a root scan (no scan_subpath), the command reduces to:
brief --json ./src > ./report.json
That is the whole workflow. If brief exits non-zero, read its stderr and write a short {"error": "..."} JSON document to ./report.json so the caller can see what went wrong rather than getting an empty file.
brief is pinned by the deployment (container image or host install). Do not try to install it here.