security-bumblebee

Scan local endpoints to inventory packages, browser extensions, and MCP servers.

7|Updated May 28, 2026

Search Tags:#security #vulnerability #audit #endpoint #supply-chain #inventory

Ready to run

npx skills add https://github.com/zcaceres/skills --skill security-bumblebee

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-bumblebee
Source: https://github.com/zcaceres/skills/tree/main/skills/security-bumblebee
Command: npx skills add https://github.com/zcaceres/skills --skill security-bumblebee

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires go, jq.

What problem does it solve?

This skill addresses the challenge of knowing exactly which software packages, browser extensions, and MCP servers are currently installed on your machine, allowing for rapid response when security advisories are released.

Core Features & Use Cases

Endpoint Inventory: Performs a read-only scan of your local machine to catalog installed software across multiple ecosystems.
Advisory Lookup: Enables direct queries to check if a specific vulnerable package version exists on your disk.
Drift Detection: Compares current scans against historical data to identify newly installed software or configuration changes.

Quick Start

Invoke the security-bumblebee skill to perform a baseline scan of your machine and identify potential supply-chain exposures.

Frequently Asked Questions about security-bumblebee

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a local endpoint inventory scan for installed packages and extensions?▼

Local endpoint inventory scanning catalogs installed packages, browser extensions, and MCP server configurations by performing a read-only scan of your machine. It generates searchable NDJSON logs to identify your current software state.

How do I check my local machine for vulnerable package versions against known security advisories?▼

Advisory lookup compares your local endpoint inventory against known vulnerability catalogs. You can query the generated NDJSON logs to check if a specific vulnerable package version exists on your disk.

What is supply-chain exposure assessment and how does drift detection work?▼

Supply-chain exposure assessment identifies risks from installed software. Drift detection compares current endpoint scans against historical NDJSON data to identify newly installed packages or configuration changes.

Do I need Go and jq to run local security audits for installed software?▼

Yes, you need Go, jq, and the bumblebee binary to execute baseline scans and generate searchable NDJSON logs. These dependencies are required to facilitate the local endpoint inventory scanning process.

Can I detect newly installed software and MCP server configuration changes on my machine?▼

Yes, drift detection compares current scans against historical data to identify newly installed software or configuration changes. This allows rapid response when security advisories are released for your installed packages.

What's the best way to audit browser extensions and MCP server configurations for supply-chain vulnerabilities?▼

The best way is performing a read-only endpoint inventory scan to catalog browser extensions and MCP server configurations. This generates searchable NDJSON logs for rapid advisory lookup and exposure assessment.