bumblebee

Scan local machine endpoints to inventory installed software packages, browser extensions, and MCP server configurations.

7|Updated May 28, 2026

Search Tags:#security #vulnerability #audit #endpoint #supply-chain #inventory

Ready to run

npx skills add https://github.com/zcaceres/skills --skill bumblebee

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: bumblebee
Source: https://github.com/zcaceres/skills/tree/main/plugins/security/skills/bumblebee
Command: npx skills add https://github.com/zcaceres/skills --skill bumblebee

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires go, jq.

What problem does it solve?

This skill addresses the difficulty of knowing exactly which software packages, browser extensions, and MCP configurations are currently installed on your machine, making it hard to assess exposure when new security advisories are released.

Core Features & Use Cases

Endpoint Inventory: Performs a read-only scan of your local machine to catalog installed packages, editor extensions, and MCP servers.
Drift Detection: Compares current scans against historical data to highlight newly installed software or configuration changes.
Advisory Lookup: Allows you to quickly check if a specific vulnerable package version is present on your system.

Quick Start

Invoke the bumblebee skill to perform an initial security baseline scan of your local machine.

Frequently Asked Questions about bumblebee

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I inventory installed software and browser extensions for security audits?▼

Endpoint supply-chain scanners perform read-only local machine scans to catalog installed packages, editor extensions, and MCP server configurations. This establishes a security baseline to assess exposure when new advisories are released.

Can I check if a specific vulnerable package version is present on my local machine?▼

You can execute advisory lookups against your local machine to quickly check if a specific vulnerable package version is present. This allows targeted vulnerability assessment without manually searching through your installed software.

How do I detect newly installed software or configuration changes on my endpoint?▼

Drift detection compares current scan results against historical security baseline data to highlight newly installed software or configuration changes. This reveals unexpected modifications to your endpoint supply-chain inventory.

Do I need Go and jq to run local endpoint supply-chain security scans?▼

Yes, you need Go 1.25+ and jq installed to execute binary-based inventory collection and NDJSON log processing. These dependencies are required to perform the local endpoint security scans.

What is endpoint supply-chain security scanning and when do I need it?▼

Endpoint supply-chain security scanning inventories installed software packages, browser extensions, and MCP configurations on your local machine. You need it to assess exposure and facilitate rapid response when new security advisories are released.