bumblebee-hygiene-scanlisted

# Bumblebee weekly supply-chain scan ## When / purpose Monday 09:00. The fleet uses many third-party MCP servers, auto-installed CLIs, packages, and skills, creating supply-chain risk. This is a read-only inventory + known-threat match. ## Binary - Path: `~/.local/bin/bumblebee` (Go build, PIN v0.1.1) - Source: `github.com/perplexityai/bumblebee` (Apache 2.0) - Build: `git clone https://github.com/perplexityai/bumblebee && cd bumblebee && go build -o ~/.local/bin/bumblebee ./cmd/bumblebee` (Go >= 1.25 required) ## Procedure 1. **Check binary exists**: ```bash if [ ! -x "$HOME/.local/bin/bumblebee" ]; then echo "bumblebee binary not found, skipping scan (install Go>=1.25 and build from github.com/perplexityai/bumblebee)" exit 0 fi ``` If the binary is missing (fresh machine without Go), gracefully skip with an info-level log line. Do NOT error out or send alerts. 2. **Locate threat-intel catalogs**: ```bash BB_CATALOG="$HOME/.claude/tools/bumblebee-threat-intel" if [ ! -d "$BB_CATALOG" ] || [ -z "$(ls -A "$BB_CATALOG" 2>/dev/null)" ]; then # Try seeded catalogs from install dir SEED_CATALOG="{{INSTALL_DIR}}/seed-scheduled-tasks/bumblebee-hygiene-scan/threat-intel" if [ -d "$SEED_CATALOG" ] && [ -n "$(ls -A "$SEED_CATALOG" 2>/dev/null)" ]; then mkdir -p "$BB_CATALOG" cp "$SEED_CATALOG"/*.json "$BB_CATALOG/" else echo "No threat-intel catalogs found, skipping scan" exit 0 fi fi ``` 3. **Run scan** (read-only, ~3 sec): ```bash ~/.local/bin/bumb