Workspace Discovery

Identifies and analyzes monorepo workspace structures across multiple programming languages and package managers for security scoping.

22|3|Updated Feb 23, 2026
One-click install
npx skills add https://github.com/allsmog/vuln-scout --skill workspace-discovery
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: Workspace Discovery
Source: https://github.com/allsmog/vuln-scout/tree/main/whitebox-pentest/skills/workspace-discovery
Command: npx skills add https://github.com/allsmog/vuln-scout --skill workspace-discovery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps identify and understand the structure of monorepos and multi-package codebases, enabling more focused and efficient security analysis.

Core Features & Use Cases

  • Monorepo Detection: Automatically detects various monorepo patterns across different package managers and build tools (npm, pnpm, yarn, Turborepo, Nx, Lerna, Go workspaces, Maven, Gradle, Cargo, Poetry).
  • Workspace Analysis: Provides insights into package boundaries, dependencies, and potential risk factors within each workspace.
  • Use Case: When presented with a large, unfamiliar codebase, use this Skill to quickly map out all the individual packages or modules, understand their relationships, and identify which ones are most critical for security review.

Quick Start

Use the workspace discovery skill to detect all monorepo packages in the current directory.

Frequently Asked Questions about Workspace Discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map monorepo package boundaries for security scoping?

To map monorepo package boundaries for security scoping, you can automatically detect workspace structures across package managers like npm, pnpm, yarn, Turborepo, Nx, and Lerna to identify dependencies and risk factors.

What is the best way to analyze an unfamiliar codebase structure across multiple package managers?

Analyzing an unfamiliar codebase structure across multiple package managers involves detecting workspace patterns across tools like Go workspaces, Maven, Gradle, Cargo, and Poetry to understand project layouts and prioritize security efforts.

Can I use workspace discovery to detect dependencies in a JavaScript monorepo?

Yes, you can detect dependencies in a JavaScript monorepo by identifying workspace structures and package boundaries across supported package managers like npm, pnpm, and yarn for focused analysis.

Does this approach work with monorepo patterns outside of JavaScript ecosystems?

Yes, this approach works with monorepo patterns outside of JavaScript ecosystems by detecting workspace structures across multiple programming languages and package managers, including Go workspaces, Maven, Gradle, Cargo, and Poetry.

When do I need to scope security audits using workspace analysis?

You need to scope security audits using workspace analysis when presented with a large, unfamiliar codebase, allowing you to understand relationships between packages and identify which modules are most critical for security review.

What are the limitations of automated codebase analysis for complex project layouts?

Automated codebase analysis for complex project layouts relies on detecting predefined workspace patterns across various package managers, meaning highly customized or non-standard monorepo configurations might not be fully recognized for dependency mapping.