菜单
Fetch high-level repository metadata (description, default branch, languages, license, stars, forks, archived status, icon) and save it against the scan's repository row. Use as the first scan on a new repository or to refresh after upstream changes.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Identify the real maintainers of a repository and the best way to contact them about a security issue. Distinguishes active leads from occasional contributors and bots, using commit history, issue activity, and registry ownership. Use when preparing a disclosure and needing to know who to reach.
Index dependencies reported by git-pkgs for the repository's manifest and lockfile files (package.json, Gemfile, go.mod, requirements.txt, etc.) and record each one with its manifest path, ecosystem, and requirement string. Use to populate the Dependencies tab.
Check whether known sinks in this application's dependencies are reachable from its own trust boundaries. Scrutineer already holds findings against the libraries this app uses; this skill traces each one from the app's entry points to the library call and reports the ones an attacker can reach. Use on applications (Gemfile.lock / package-lock.json present), not on libraries.
Generate a CycloneDX Software Bill of Materials for the repository. Use when you want a standard-format inventory of components for downstream tooling, compliance, or archival. Stored verbatim on the scan.
Fetch the published security advisories that affect any package produced by this repository. Use to populate the Advisories tab with existing GHSA and CVE records so analysts can see what is already public before triaging new findings.
For each published package of this repository, fetch the top runtime dependents so later exposure-analysis skills have a ranked shortlist to work against. Use after the packages skill has populated which packages exist.
| name | metadata |
| description | Fetch high-level repository metadata (description, default branch, languages, license, stars, forks, archived status, icon) and save it against the scan's repository row. Use as the first scan on a new repository or to refresh after upstream changes. |
| license | MIT |
| compatibility | Needs network access to repos.ecosyste.ms. |
| allowed-tools | Read,Write,WebFetch,Grep,Glob,LS |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"repo_metadata","scrutineer.requires_remote":true} |
Populate repository metadata from repos.ecosyste.ms. One API call, one flat JSON document.
./context.json — has repository.url (the git URL of the target repo)./report.json — write the flat metadata here./schema.json — output shape./context.json and extract repository.url.https://repos.ecosyste.ms/api/v1/repositories/lookup?url={URL-ENCODED_URL}. Follow redirects.metadata blob (the parser stores it as Repository.Metadata)../report.json exactly as ./schema.json describes:
full_name from upstream full_nameowner from upstream ownerdescription from upstream descriptiondefault_branch from upstream default_branchlanguages as a plain array of names (upstream returns an object like {"Go": 90, "JavaScript": 10}; take the keys)license from upstream license (string, not object)stars from upstream stargazers_countforks from upstream forks_countarchived from upstream archivedpushed_at from upstream pushed_at (RFC3339 string)html_url from upstream html_urlicon_url from upstream icon_url if presentOmit any field upstream did not provide rather than making one up. If the lookup returns nothing, write {} and exit 0 — the parser handles an empty map cleanly.