菜单
Map native languages, extension bridges, build tools, manifests, and dependencies after shallow Git submodules have been initialized. Runs when triage finds native-extension, submodule, or mixed native-language signals.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/alpha-omega-security/scrutineer --skill embedded-native命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Re-run a finding's reproduction against current HEAD, test its attack tree, grade five fixed evidence criteria, and account for every matched design control.
Judge whether a validated finding can affect a real release build, and record the attacker position, preconditions, impact, counterevidence, and facts that could change that conclusion. Finding-scoped and read-only.
Draft the disclosure content for a finding in GitHub Security Advisory shape. Produces a title, markdown description, affected package block, CVSS vector, CWE list, references, and a suggested-recipients list from CODEOWNERS or git history, then writes them back to the finding so the analyst can paste them into the GHSA form (or POST to GitHub's repository-advisories REST endpoint) rather than composing from scratch.
正在显示 SKILL.md
| name | embedded-native |
| description | Map native languages, extension bridges, build tools, manifests, and dependencies after shallow Git submodules have been initialized. Runs when triage finds native-extension, submodule, or mixed native-language signals. |
| license | MIT |
| compatibility | Requires the `brief` CLI (https://github.com/git-pkgs/brief) on PATH. Shallow submodule initialization is available for remote repository scans. |
| metadata | {"scrutineer.model":"mid","scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"freeform","scrutineer.recurse_submodules":true,"scrutineer.paths":["**"]} |
Run Brief after Scrutineer has prepared the repository with recursive, depth-one Git submodules. A root Brief scan can omit files inside initialized submodules, so the bundled script runs Brief separately at each submodule root and keeps every report unchanged inside one envelope.
Run:
bash ./scripts/scan.sh ./src ./report.json
The report contains schema_version, the root Brief report under root, Git submodule identities under components, and Brief reports under submodules. Scrutineer supplies components with each checkout-relative path, resolved source URL, exact gitlink commit, pinned package URL under purl, initialization status, and any identity error. Join a submodule Brief report to a component by resolving the report path relative to the root report path. Do not edit embedded-native-components.json, summarize, filter, merge, or infer components from the Brief results.
If Brief exits non-zero, read stderr and write {"error":"brief: ..."} to ./report.json. Do not install or modify Brief.