Loading...
Loading...
Found 8 Skills
Run Google's OSV-Scanner for Software Composition Analysis. Scans lockfiles and SBOMs across all major ecosystems (npm, PyPI, Maven, Go, Cargo, NuGet, RubyGems) for known vulnerabilities.
Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check. Identify and remediate vulnerable libraries in your software supply chain. Use when managing third-party dependencies or implementing software composition analysis.
Mend integration. Manage data, records, and automate workflows. Use when the user wants to interact with Mend data.
Sonatype integration. Manage data, records, and automate workflows. Use when the user wants to interact with Sonatype data.
Use when choosing, proposing, reviewing, or declaring a new dependency or development tool, including temporary package runner acquisitions. Also use when changing a dependency’s or tool’s prescribed features, source, or version. Do not use merely to reuse an existing project dependency, install or restore already prescribed dependencies, incorporate existing dependency declarations through authorized history integration, or conduct a general dependency inventory or security audit without a selection decision.
Ghi và kiểm provenance (nguồn + sha256 checksum) cho skill — dùng khi 'cài skill từ ngoài', 'skill này từ đâu', 'audit nguồn skill', 'checksum skill', 'supply-chain skill', phát hiện skill bị sửa lén; bổ trợ orca-sec-scans. Chạy fdk/tools/skill-provenance.py. /skill-provenance
Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.
Use when a project has package manifests and lockfiles and you want to know about known-vulnerable, abandoned, or suspicious dependencies before launch, without running install scripts. It reads manifests and lockfiles, uses the ecosystem's audit tooling where safe, and proposes minimal, non-breaking upgrades. Do not use it to upgrade major versions automatically, run untrusted install scripts, or claim a project is free of vulnerabilities.