advisories

Fetch published security advisories for repository packages via the ecosystem advisories API.

Updated May 20, 2026

Search Tags:#security #api #vulnerabilities #triage #report #package #advisories

Ready to run

npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill advisories

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: advisories
Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/advisories
Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill advisories

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Fetch the published security advisories that affect any package produced by this repository. Use to populate the Advisories tab with existing GHSA and CVE records so analysts can see what is already public before triaging new findings.

Core Features & Use Cases

Retrieve advisories from the ecosystem advisories API for the repository URL, including pagination.
Normalize and emit a structured list of advisories to report.json under the advisories key with fields such as uuid, url, title, description, severity, cvss_score, classification, packages, published_at, and withdrawn_at.
Ideal for security triage workflows, risk analysis, and compliance reporting by teams monitoring third-party package advisories.

Quick Start

Run the advisories skill to fetch advisories for this repository and write them to ./report.json.

Frequently Asked Questions about advisories

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I fetch published security advisories for packages in my repository?▼

The skill retrieves security advisories by querying the ecosystem advisories API for your repository URL, paginating through results, and writing structured records to report.json.

What data fields are included when retrieving CVE and GHSA security advisories?▼

Advisory records include uuid, url, title, description, severity, cvss_score, classification, packages, published_at, and withdrawn_at to support security triage workflows.

Can I retrieve all vulnerability advisories if the API returns multiple pages?▼

Yes, the skill supports pagination to gather all advisories from the ecosystem API, ensuring complete retrieval of vulnerability records across multiple pages.

Do I need network access to pull package advisories into a JSON report?▼

Yes, network access is required to query the ecosystem advisories API and populate the advisories array in report.json with the fetched vulnerability records.

Why use an automated advisories report for security triage workflows?▼

Automated advisories reporting populates the Advisories tab with existing GHSA and CVE records, letting analysts see public vulnerabilities before triaging new findings.