菜单
Fetch repository metadata (description, default branch, languages, license, stars, archived, icon) from repos.ecosyste.ms and save it on the repository row.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/alpha-omega-security/scrutineer --skill metadata命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Re-run a finding's reproduction against current HEAD, test its attack tree, grade five fixed evidence criteria, and account for every matched design control.
Judge whether a validated finding can affect a real release build, and record the attacker position, preconditions, impact, counterevidence, and facts that could change that conclusion. Finding-scoped and read-only.
Draft the disclosure content for a finding in GitHub Security Advisory shape. Produces a title, markdown description, affected package block, CVSS vector, CWE list, references, and a suggested-recipients list from CODEOWNERS or git history, then writes them back to the finding so the analyst can paste them into the GHSA form (or POST to GitHub's repository-advisories REST endpoint) rather than composing from scratch.
基于 SOC 职业分类
正在显示 SKILL.md
| name | metadata |
| description | Fetch repository metadata (description, default branch, languages, license, stars, archived, icon) from repos.ecosyste.ms and save it on the repository row. |
| license | MIT |
| compatibility | Prefers the scrutineer API's cached ecosyste.ms payload; needs network access to repos.ecosyste.ms only when nothing is cached. |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"repo_metadata","scrutineer.requires_remote":true,"scrutineer.model":"mid"} |
Populate repository metadata from repos.ecosyste.ms. One API call, one flat JSON document.
./context.json — has repository.url (the git URL of the target repo), plus scrutineer.api_base, scrutineer.token and scrutineer.repository_id./report.json — write the flat metadata here./schema.json — output shape./context.json and extract repository.url, scrutineer.api_base, scrutineer.token and scrutineer.repository_id.GET {api_base}/repositories/{repository_id}/ecosystems/repo/raw with the bearer token. A 200 is the verbatim upstream lookup response — use it and go to step 4. This is the only path that works under --hardened, where ecosyste.ms is not in the egress allowlist, and it avoids a redundant external fetch otherwise.ecosystems_enrichment: false — so fetch https://repos.ecosyste.ms/api/v1/repositories/lookup?url={URL-ENCODED_URL} directly. Follow redirects.metadata blob (the parser stores it as Repository.Metadata)../report.json exactly as ./schema.json describes:
full_name from upstream full_nameowner from upstream ownerdescription from upstream descriptiondefault_branch from upstream default_branchlanguages as a plain array of names (upstream returns an object like {"Go": 90, "JavaScript": 10}; take the keys)license from upstream license (string, not object)stars from upstream stargazers_countforks from upstream forks_countarchived from upstream archivedpushed_at from upstream pushed_at (RFC3339 string)html_url from upstream html_urlicon_url from upstream icon_url if presentOmit any field upstream did not provide rather than making one up. If the lookup genuinely returns nothing, write {} and exit 0 — the parser handles an empty map cleanly.
If neither source is reachable — the cached endpoint returned 404 and the direct fetch failed, which is what --hardened looks like on an uncached repository — do not write ./report.json at all. Exit non-zero instead. An empty document here is a claim that upstream knows nothing about this repository, and it blanks the stored metadata blob and zeroes stars/forks on the row.