DevInder1
UserSupply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.
Categories
Indexed Skills (6)
fix-plan
Generate an EPSS/KEV-prioritised remediation plan from a scan. Returns the top findings ranked by real-world exploitation risk with copy-paste upgrade commands, semver-jump risk classification (PATCH/MINOR/MAJOR), and a recommendation per package. Use when the user asks for "what should I fix first", "remediation plan", "how do I patch this", or "fix script".
quick-scan
Fast cached-only scan of project dependencies for high-severity CVEs. Uses the local advisory cache without making fresh network calls — sub-second for most projects. Use when the user wants a pre-commit check, a fast pulse on supply-chain risk, or is offline. For thorough live-advisory checks use `scan` or `supply-chain-scan` instead.
scan-full
Comprehensive scan covering project dependencies PLUS OS/system packages (Homebrew on macOS, apt/dnf on Linux) PLUS installed IDE extensions (VS Code marketplace + JetBrains plugins). Most other supply-chain scanners only check project manifests and miss system + IDE surfaces. Use whenever the user asks for "complete coverage", "full audit", scanning their "whole machine" or "system", or wants to check IDE extension security.
scan
Full project dependency scan with live advisory fetch (OSV, NVD, GHSA) and EPSS exploit-probability + CISA KEV prioritisation. Covers npm and PyPI manifests + lockfiles. Use when the user wants thorough, up-to-date supply-chain CVE coverage for their project — but does NOT need system packages or IDE extensions (for those use `scan-full`).
validate-fixes
Re-scan after a dependency upgrade and confirm the CVEs are actually resolved. Use when the user has just run `npm update`, `pip install -U`, applied a patch, or otherwise upgraded packages and wants verification. Diffs a baseline scan against the post-patch scan and reports resolved_count, remaining_count, new_count, and validation_passed.
why
Explain why a specific vulnerable package is in the project — direct vs transitive dependency, which CVE IDs apply, EPSS exploit-probability score, whether it's on the CISA KEV catalog, and the recommended fix command. Use when the user asks "why is X vulnerable", "where does X come from", or "is X actually exploitable".
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.