菜单
Run `brief --json` to produce a structured overview of the repository. Used by other skills as orientation.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/alpha-omega-security/scrutineer --skill repo-overview命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Re-run a finding's reproduction against current HEAD, test its attack tree, grade five fixed evidence criteria, and account for every matched design control.
Judge whether a validated finding can affect a real release build, and record the attacker position, preconditions, impact, counterevidence, and facts that could change that conclusion. Finding-scoped and read-only.
Draft the disclosure content for a finding in GitHub Security Advisory shape. Produces a title, markdown description, affected package block, CVSS vector, CWE list, references, and a suggested-recipients list from CODEOWNERS or git history, then writes them back to the finding so the analyst can paste them into the GHSA form (or POST to GitHub's repository-advisories REST endpoint) rather than composing from scratch.
基于 SOC 职业分类
正在显示 SKILL.md
| name | repo-overview |
| description | Run `brief --json` to produce a structured overview of the repository. Used by other skills as orientation. |
| license | MIT |
| compatibility | Requires the `brief` CLI (https://github.com/git-pkgs/brief) on PATH. |
| metadata | {"scrutineer.model":"mid","scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"repo_overview"} |
Produce an overview of the repository cloned at ./src by invoking the brief tool and writing its output verbatim as the report. brief already does the reading, summarising, and structured-output work; this skill is the thin harness around it.
./src — the cloned repository./report.json — write the final report hereRun brief against the whole repository and write its output verbatim:
brief --json ./src > ./report.json
This skill always describes the whole repository, even on a scan scoped to a monorepo sub-package. It deliberately ignores scrutineer.scan_subpath: its output populates repository-level fields (languages, default branch, license) that have no per-sub-package home, so running brief against one sub-folder would overwrite the repository's metadata with a single sub-package's. Enumerating a monorepo's sub-packages is the subprojects skill's job, not this one's.
That is the whole workflow. If brief exits non-zero (including when it is missing), read its stderr and write a short {"error": "..."} JSON document to ./report.json so the caller can see what went wrong rather than getting an empty file. Do not post-process brief's output; the consumer expects its native schema. Do not try to install brief; it is pinned by the deployment.