skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

package-triage

Triage npm, PyPI, or RubyGems packages for malware, CVEs, and supply chain risks.

11|1|Updated May 4, 2026
Search Tags:#software security#vulnerability scanning#supply chain security#artifact analysis#package triage#CVE checking#package safety
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill package-triage
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: package-triage
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/secure-software/skills/package-triage
Command: npx skills add https://github.com/dreadnode/capabilities --skill package-triage

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually vetting software packages for security risks requires switching between multiple databases and tools, taking hours and often missing critical threats like malware or unpatched CVEs.

Core Features & Use Cases

  • Multi-source risk aggregation: Combines Spectra Assure Community reports, OSV vulnerability data, and OpenSSF Scorecard metrics to build a complete risk profile for any package.
  • Artifact tampering detection: Inspects downloaded package archives for obfuscated code, high-entropy files, and malicious patterns that may not appear in public vulnerability databases.
  • Use case: A developer evaluating a new open source library for a production project can use this skill to get a clear adopt/avoid verdict with concrete supporting evidence in minutes instead of hours of manual research.

Quick Start

Use the package-triage skill to evaluate the safety of the lodash 4.17.21 npm package.

Frequently Asked Questions about package-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check an npm or PyPI package for malware and supply chain risk?▼

To check a package for malware and supply chain risk, aggregate Spectra Assure reports, OSV vulnerability data, and OpenSSF Scorecard metrics to produce an evidence-backed safety verdict for npm, PyPI, or RubyGems packages.

What is the best way to triage suspicious software packages for known CVEs?▼

The best way to triage suspicious packages for known CVEs is querying OSV vulnerability databases alongside OpenSSF Scorecard checks, combining static artifact inspection to detect obfuscated code and unpatched vulnerabilities.

Can I detect artifact tampering and high-entropy files in downloaded package archives?▼

Yes, you can detect artifact tampering by performing static artifact inspection on downloaded package archives, identifying obfuscated code, high-entropy files, and malicious patterns not appearing in public vulnerability databases.

How do I get a clear adopt or avoid verdict for a new open source library?▼

To get a clear adopt or avoid verdict for a new open source library, aggregate multi-source risk data including OpenSSF Scorecard metrics and static analysis to evaluate malware risk, CVEs, and supply chain hygiene.

Does package triage work with RubyGems as well as npm and PyPI?▼

Yes, package triage works with RubyGems, npm, and PyPI packages, applying Spectra Assure Community reports, OSV queries, and OpenSSF Scorecard checks to evaluate supply chain hygiene and known vulnerabilities across these ecosystems.

Related Skills

Explore More Software Engineering Skills→
itechmeatitechmeat
22

deps-dev

Identifies the latest stable version of a package from any supported ecosystem using the SwaggerHub API's built-in feature.

Community
Basic
SjdjdiejdrirhdkjejSjdjdiejdrirhdkjej

optimization-phase

Run post-implementation quality gates and generate reports before release.

Community
Advanced
robit-manrobit-man

supply-chain-forensics

Analyze dependency integrity, build pipelines, and SBOM composition for supply chain security.

Community
Advanced
transilienceaitransilienceai
462

cve-testing

Coordinate CVE vulnerability testing across identified technology stacks and APIs.

Official
Basic