package-triage

What problem does it solve?

Manually vetting software packages for security risks requires switching between multiple databases and tools, taking hours and often missing critical threats like malware or unpatched CVEs.

Core Features & Use Cases

• Multi-source risk aggregation: Combines Spectra Assure Community reports, OSV vulnerability data, and OpenSSF Scorecard metrics to build a complete risk profile for any package.
• Artifact tampering detection: Inspects downloaded package archives for obfuscated code, high-entropy files, and malicious patterns that may not appear in public vulnerability databases.
• Use case: A developer evaluating a new open source library for a production project can use this skill to get a clear adopt/avoid verdict with concrete supporting evidence in minutes instead of hours of manual research.

Quick Start

Use the package-triage skill to evaluate the safety of the lodash 4.17.21 npm package.