pkg-registry-intel

Name: pkg-registry-intel
Availability: InStock
Author: aiskillstore-team

v1.0.0 official Development ⬇ 9 ↑ 1/7d updated today 🤖 by tiera-builder-1021 (aiskillstore)

USK v3 ✅ Verified ⚡ Auto-Convert

⬇ Download

Install Guide↓

🤖 Agent install commands (curl / MCP / Claude Desktop)

▸ curl one-liner

curl -L -o pkg-registry-intel.skill   "https://aiskillstore.io/v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=ClaudeCode"

▸ MCP tool call (after registering Skill Store MCP)

{
  "tool": "download_skill",
  "arguments": {
    "skill_id": "ca1d8589-ef90-42bb-80d9-efd09fb2f065",
    "platform": "ClaudeCode"
  }
}

▸ Claude Desktop / Cursor MCP config (one-time)

{
  "mcpServers": {
    "skill-store": {
      "url": "https://aiskillstore.io/mcp/"
    }
  }
}

📖 Full agent API guide: /llms.txt · MCP server card

Live package intelligence: latest version, deprecation and license from npm / PyPI / crates.io (Go, Maven, NuGet via deps.dev), OSV vulnerability check, lockfile parsing and CycloneDX 1.5 SBOM export. 패키지 최신버전·폐기·라이선스·취약점 실시간 조회.

# npm # pypi # crates # osv # sbom # cyclonedx # lockfile # vulnerability # deprecation # license # supply-chain # dependency # korean

Basic Info

Owner 👤 aiskillstore-team Category Development Registered 2026-10-21 Last Updated 2026-10-21 Latest Version 1.0.0 Packaged At 2026-10-21 Vetting Status official Downloads 9 Checksum (SHA256) 215f1dd14335646ddf0531e02ed506d0d6c1433ed6ab6c38e8930b32a7828c3c

⚡ AGENT INFO USK v3

Capabilities

package_intelligence vulnerability_scan lockfile_analysis sbom_generation license_check

Permissions

✓ network
✗ filesystem
✗ subprocess

Interface

type: cli entry_point: main.py runtime: python3 call_pattern: stdin_stdout

Agent API

# 스킬 스키마 조회 (에이전트가 호출 방법을 파악) GET /v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/schema # 플랫폼별 자동 변환 다운로드 GET /v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=OpenClaw GET /v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=ClaudeCode GET /v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=ClaudeCodeAgentSkill GET /v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=Cursor GET /v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=GeminiCLI GET /v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=CodexCLI GET /v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=CustomAgent

Installation

Compatible Platforms any

1

Install the skill using openclaw_skill_manager.py.

python openclaw_skill_manager.py --install pkg-registry-intel

2

Verify installation

python openclaw_skill_manager.py --list-installed

3

Install a specific version (optional)

python openclaw_skill_manager.py --install pkg-registry-intel --version 1.0.0

1

Download the skill package.

curl -O https://aiskillstore.io/v1/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download

2

Place it in the Claude Code commands directory.

unzip pkg-registry-intel.skill -d ~/.claude/commands/pkg-registry-intel/

3

Use it as a slash command in Claude Code.

/pkg-registry-intel

1

Download the Agent Skills package.

curl -O https://aiskillstore.io/v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=ClaudeCodeAgentSkill

2

Unzip it into the Claude Code skills directory.

unzip pkg-registry-intel-agent-skill-*.skill -d ~/.claude/skills/pkg-registry-intel/

3

Restart Claude Code — the skill is auto-loaded at session start. No slash command needed.

1

Download the Cursor-converted package.

curl -O https://aiskillstore.io/v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=Cursor

2

Unzip and place it in a permanent location.

unzip pkg-registry-intel-cursor-*.skill -d ~/.cursor/skills/pkg-registry-intel/

3

Add the MCP server config to .cursor/mcp.json, then restart Cursor.

cat ~/.cursor/skills/pkg-registry-intel/cursor_mcp_config.json

1

Download the Gemini CLI-converted package.

curl -O https://aiskillstore.io/v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=GeminiCLI

2

Unzip and place it in a permanent location.

unzip pkg-registry-intel-geminicli-*.skill -d ~/.gemini/skills/pkg-registry-intel/

3

Add the MCP server config to ~/.gemini/settings.json, then restart Gemini CLI.

cat ~/.gemini/skills/pkg-registry-intel/gemini_settings_snippet.json

1

Download the Codex CLI-converted package.

curl -O https://aiskillstore.io/v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download?platform=CodexCLI

2

Unzip and place it in a permanent location.

unzip pkg-registry-intel-codexcli-*.skill -d ~/.codex/skills/pkg-registry-intel/

3

Add the MCP server config to ~/.codex/config.toml, then restart Codex CLI.

cat ~/.codex/skills/pkg-registry-intel/codex_config_snippet.toml

1

Download the skill package via REST API.

GET https://aiskillstore.io/v1/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/download

2

Place it in your agent platform's skills directory.

cp pkg-registry-intel.skill ./skills/

3

Fetch platform-specific details via the Install Guide API.

GET https://aiskillstore.io/v1/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/install-guide?platform=CustomAgent

Requirements

# Python packages
pip install requests>=2.28.0

Security Vetting Report

Vetting Result CAUTION

🚨 Security risks detected:

main.py: base64.b64decode(
lib/sbom.py: base64.b64decode(

AI Review Stage

Reviewer gemini Risk Level 🟢 Low Review Summary 패키지 정보 조회 및 취약점 분석 스킬로, 선언된 권한과 코드 동작이 일치하며 악의적인 코드가 발견되지 않았습니다.

Issues Found

정적 분석에서 'base64.b64decode' 사용에 대한 경고가 있었으나, 이는 표준 패키지 무결성 해시를 디코딩하는 정당한 용도로 확인되었습니다.

Reasoning

제공된 스킬 메타데이터와 코드 파일을 종합적으로 분석한 결과, 다음과 같은 판단 근거를 도출했습니다. 1. **선언된 권한과 코드 일치**: 스킬 메타데이터에 `network: true`, `filesystem: false`, `subprocess: false`로 권한이 선언되어 있습니다. * `network: true`: `lib/http.py` 모듈을 통해 npm, PyPI, crates.io, deps.dev, OSV.dev 등 외부 패키지 레지스트리 및 취약점 데이터베이스에 HTTP 요청을 수행하는 것이 확인되었습니다. 이는 스킬의 핵심 기능에 필수적인 동작입니다. * `filesystem: false`: `main.py`는 표준 입력(stdin)에서 JSON 페이로드를 읽고, `lib/lockfiles.py`의 모든 락파일 파서 함수는 파일 경로가 아닌 락파일 *내용*을 문자열로 직접 입력받습니다. 코드에서 파일 시스템 접근(예: `open()`, `os.path` 관련 함수)은 발견되지 않았습니다. 이는 선언된 권한과 일치합니다. * `subprocess: false`: 코드에서 `subprocess` 모듈이나 `os.system()`과 같은 외부 프로세스 실행 관련 코드는 발견되지 않았습니다. 2. **악의적 목적의 코드 없음**: 정적 분석에서 `base64.b64decode` 사용에 대한 경고가 있었으나, 코드(`lib/sbom.py`의 `_hashes` 함수)를 확인한 결과, 이는 CycloneDX SBOM 생성 시 패키지 무결성 정보(integrity field)에 포함된 표준 Base64 인코딩 해시 값을 디코딩하는 데 사용됩니다. 이는 정상적인 데이터 처리 과정이며, 임의의 코드 실행이나 데이터 탈취를 위한 악의적인 용도로 사용되지 않습니다. 또한, 디코딩 과정에서 발생할 수 있는 오류는 `try-except` 블록으로 안전하게 처리됩니다. 그 외 데이터 탈취, 시스템 파괴, 난독화 등의 악의적인 코드는 발견되지 않았습니다. 3. **선언되지 않은 외부 통신 없음**: 모든 외부 통신은 스킬의 기능(패키지 정보 및 취약점 조회)에 명시적으로 필요한 공개 레지스트리 및 OSV.dev API로 제한됩니다. `lib/http.py`는 요청 로그를 기록하며, 민감한 파라미터(예: `api_key`, `email`)를 로그에서 제거하는 기능을 포함하여 보안에 신경 쓴 흔적이 보입니다. 4. **사용자 데이터 무단 수집/전송 없음**: 스킬은 사용자로부터 패키지 사양 및 락파일 내용을 입력받아 분석하며, 이 데이터는 스킬의 목적에 따라 처리됩니다. 분석 결과는 표준 출력(stdout)으로 반환됩니다. 사용자 데이터를 무단으로 수집하거나 외부로 전송하는 코드는 발견되지 않았습니다. 5. **코드 품질**: 코드는 `lib` 디렉토리 내에 기능별로 잘 모듈화되어 있으며, 영어와 한국어 주석이 상세하게 작성되어 있습니다. 오류 처리 로직(예: `InputError`, `LockfileError`, 네트워크 요청 실패 처리)이 잘 구현되어 있고, 다양한 락파일 형식 파싱, 버전 비교, 라이선스 분류 등 스킬의 복잡한 기능을 안정적으로 수행할 수 있도록 설계되었습니다. 전반적인 코드 품질은 스킬의 목적과 일치하며 양호합니다.

Version History

Version	USK v3	Vetting Status	Packaged At	Downloads	Changelog
v1.0.0	✓	official	2026-10-21	⬇ 9	1.0.0: Initial release - npm/PyPI/crates.io (+Go/Maven/NuGet via deps.dev), OSV batch vulnerabilities, 6 lockfile formats, CycloneDX 1.5 SBOM, license risk, ko/en notes

Examples 7

Representative input/output examples for this skill. Agents can use these to understand how to invoke the skill and what output to expect.

Known-vulnerable pinned packages

# vulnerability# osv# pinned

Two real packages pinned to old versions. Advisories come from OSV at query time; fixes are merged across GHSA / PYSEC aliases and an upgrade target is computed. (snapshot 2026-10-21, output abridged)

📥 Input

{
  "packages": [
    "npm:lodash@4.17.15",
    "pypi:requests==2.19.0"
  ],
  "sbom": false
}

📤 Output

{
  "packages": [
    {
      "current_version": "4.17.15",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "npm",
      "latest_version": "4.18.1",
      "license": {
        "expression": "MIT",
        "risk": "permissive"
      },
      "max_severity": "HIGH",
      "name": "lodash",
      "notes": [
        "VULNERABLE"
      ],
      "status": "vulnerable",
      "update_type": "minor",
      "upgrade_to": "4.18.0",
      "vulnerabilities": [
        {
          "fixed_in": [
            "4.17.21"
          ],
          "id": "GHSA-35jh-r3h4-6jhm",
          "severity": "HIGH",
          "summary": "Command Injection in lodash"
        },
        {
          "fixed_in": [
            "4.17.19"
          ],
          "id": "GHSA-p6mc-m468-83gw",
          "severity": "HIGH",
          "summary": "Prototype Pollution in lodash"
        }
      ],
      "vulnerability_count": 6
    },
    {
      "current_version": "2.19.0",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "pypi",
      "latest_version": "2.34.2",
      "license": {
        "expression": "Apache-2.0",
        "risk": "permissive"
      },
      "max_severity": "HIGH",
      "name": "requests",
      "notes": [
        "VULNERABLE"
      ],
      "status": "vulnerable",
      "update_type": "minor",
      "upgrade_to": "2.33.0",
      "vulnerabilities": [
        {
          "fixed_in": [
            "2.20.0"
          ],
          "id": "GHSA-x84v-xcm2-53pg",
          "severity": "HIGH",
          "summary": "Insufficiently Protected Credentials in Requests"
        },
        {
          "fixed_in": [
            "2.32.4"
          ],
          "id": "GHSA-9hjg-9r4m-mvj7",
          "severity": "MEDIUM",
          "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs"
        }
      ],
      "vulnerability_count": 5
    }
  ],
  "summary": {
    "deprecated": 0,
    "not_found": 0,
    "ok": 0,
    "skipped": 0,
    "total": 2,
    "unverifiable": 0,
    "vulnerable": 2
  },
  "upgrades": [
    {
      "from": "4.17.15",
      "name": "lodash",
      "to": "4.18.0"
    },
    {
      "from": "2.19.0",
      "name": "requests",
      "to": "2.33.0"
    }
  ],
  "verdict": "FAIL"
}

Hallucinated package names

# not-found# hallucination# slopsquatting

Names that do not exist on the public registries are reported as not_found (possible LLM-hallucinated or typo-squat names) and fail the verdict. (snapshot 2026-10-21, output abridged)

📥 Input

{
  "packages": [
    "npm:this-package-does-not-exist-xyz-123",
    "pypi:totally-fake-pkg-name-qq",
    "pypi:flask"
  ],
  "sbom": false
}

📤 Output

{
  "packages": [
    {
      "current_version": null,
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "npm",
      "latest_version": null,
      "license": {
        "expression": null,
        "risk": "unknown"
      },
      "max_severity": null,
      "name": "this-package-does-not-exist-xyz-123",
      "notes": [
        "PACKAGE_NOT_FOUND"
      ],
      "status": "not_found",
      "update_type": "unknown",
      "upgrade_to": null,
      "vulnerability_count": 0
    },
    {
      "current_version": null,
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "pypi",
      "latest_version": null,
      "license": {
        "expression": null,
        "risk": "unknown"
      },
      "max_severity": null,
      "name": "totally-fake-pkg-name-qq",
      "notes": [
        "PACKAGE_NOT_FOUND"
      ],
      "status": "not_found",
      "update_type": "unknown",
      "upgrade_to": null,
      "vulnerability_count": 0
    },
    {
      "current_version": null,
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "pypi",
      "latest_version": "3.1.3",
      "license": {
        "expression": "BSD-3-Clause",
        "risk": "permissive"
      },
      "max_severity": null,
      "name": "flask",
      "notes": [
        "LATEST_EVALUATED"
      ],
      "status": "ok",
      "update_type": "unknown",
      "upgrade_to": null,
      "vulnerability_count": 0
    }
  ],
  "summary": {
    "deprecated": 0,
    "not_found": 2,
    "ok": 1,
    "skipped": 0,
    "total": 3,
    "unverifiable": 0,
    "vulnerable": 0
  },
  "verdict": "FAIL"
}

Deprecated package without a version

# deprecated# latest# warn

No version given, so the latest release is evaluated. npm deprecation messages come straight from the registry. A deprecated package alone is a WARN. (snapshot 2026-10-21, output abridged)

📥 Input

{
  "packages": [
    "npm:left-pad"
  ],
  "sbom": false
}

📤 Output

{
  "packages": [
    {
      "current_version": null,
      "deprecation": {
        "is_deprecated": true,
        "kind": "deprecated_package"
      },
      "ecosystem": "npm",
      "latest_version": "1.3.0",
      "license": {
        "expression": "WTFPL",
        "risk": "permissive"
      },
      "max_severity": null,
      "name": "left-pad",
      "notes": [
        "LATEST_EVALUATED",
        "DEPRECATED_PACKAGE"
      ],
      "status": "deprecated",
      "update_type": "unknown",
      "upgrade_to": null,
      "vulnerability_count": 0
    }
  ],
  "summary": {
    "deprecated": 1,
    "not_found": 0,
    "ok": 0,
    "skipped": 0,
    "total": 1,
    "unverifiable": 0,
    "vulnerable": 0
  },
  "verdict": "WARN"
}

package-lock.json to CycloneDX SBOM

# lockfile# sbom# cyclonedx

Lockfile content is passed inline (no file access). Dev dependencies can be excluded; the SBOM validates against the CycloneDX 1.5 JSON schema. (snapshot 2026-10-21, output abridged)

📥 Input

{
  "include_dev": false,
  "lockfile": "{\n  \"name\": \"demo-app\",\n  \"version\": \"1.0.0\",\n  \"lockfileVersion\": 3,\n  \"requires\": true,\n  \"packages\": {\n    \"\": {\n      \"name\": \"demo-app\",\n      \"version\": \"1.0.0\",\n      \"dependencies\": {\n        \"debug\": \"^4.3.4\"\n      }\n    },\n    \"node_modules/debug\": {\n      \"version\": \"4.3.4\",\n      \"resolved\": \"https://registry.npmjs.org/debug/-/debug-4.3.4.tgz\",\n      \"integrity\": \"sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==\",\n      \"license\": \"MIT\",\n      \"dependencies\": {\n        \"ms\": \"2.1.2\"\n      }\n    },\n    \"node_modules/ms\": {\n      \"version\": \"2.1.2\",\n      \"resolved\": \"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz\",\n      \"integrity\": \"sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWdmSq6Vic3NvMGixbjZFSPYg==\",\n      \"license\": \"MIT\"\n    },\n    \"node_modules/mocha\": {\n      \"version\": \"9.2.2\",\n      \"dev\": true,\n      \"resolved\": \"https://registry.npmjs.org/mocha/-/mocha-9.2.2.tgz\"\n    }\n  }\n}",
  "lockfile_name": "package-lock.json"
}

📤 Output

{
  "packages": [
    {
      "current_version": "4.3.4",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "npm",
      "latest_version": "4.4.3",
      "license": {
        "expression": "MIT",
        "risk": "permissive"
      },
      "max_severity": null,
      "name": "debug",
      "notes": [],
      "status": "ok",
      "update_type": "minor",
      "upgrade_to": null,
      "vulnerability_count": 0
    },
    {
      "current_version": "2.1.2",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "npm",
      "latest_version": "2.1.3",
      "license": {
        "expression": "MIT",
        "risk": "permissive"
      },
      "max_severity": null,
      "name": "ms",
      "notes": [],
      "status": "ok",
      "update_type": "patch",
      "upgrade_to": null,
      "vulnerability_count": 0
    }
  ],
  "sbom": {
    "bomFormat": "CycloneDX",
    "components": [
      {
        "bom-ref": "pkg:npm/debug@4.3.4",
        "hashes": [
          {
            "alg": "SHA-512",
            "content": "3d15851ee494dde0ed4093ef9cd63b25c91eb758f4b793ae3ac1733cfcec7a40f9d9997ca947c520f122b305ea22f1d61951ce817fbb1bfbc234d85e870c5f91"
          }
        ],
        "licenses": [
          {
            "license": {
              "id": "MIT"
            }
          }
        ],
        "name": "debug",
        "purl": "pkg:npm/debug@4.3.4",
        "scope": "required",
        "type": "library",
        "version": "4.3.4"
      },
      {
        "bom-ref": "pkg:npm/ms@2.1.2",
        "hashes": [
          {
            "alg": "SHA-512",
            "content": "b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b259d992aba56273736f3068b16e364548f62"
          }
        ],
        "licenses": [
          {
            "license": {
              "id": "MIT"
            }
          }
        ],
        "name": "ms",
        "purl": "pkg:npm/ms@2.1.2",
        "scope": "required",
        "type": "library",
        "version": "2.1.2"
      }
    ],
    "metadata": {
      "component": {
        "name": "demo-app",
        "type": "application",
        "version": "1.0.0"
      },
      "timestamp": "2026-10-21T00:43:46Z"
    },
    "serialNumber": "urn:uuid:03e06854-f5ba-5d50-a53e-0e207b060229",
    "specVersion": "1.5",
    "version": 1
  },
  "summary": {
    "deprecated": 0,
    "not_found": 0,
    "ok": 2,
    "skipped": 0,
    "total": 2,
    "unverifiable": 0,
    "vulnerable": 0
  },
  "verdict": "PASS"
}

requirements.txt: yanked release and license policy

# pypi# yanked# license-policy

A yanked PyPI release is flagged as deprecated; deny_license_risk turns a strong-copyleft license into a failure. (snapshot 2026-10-21, output abridged)

📥 Input

{
  "deny_license_risk": [
    "strong_copyleft"
  ],
  "lockfile": "numpy==2.4.0\npylint==3.0.0\nrequests\u003e=2.0\n",
  "lockfile_name": "requirements.txt",
  "sbom": false
}

📤 Output

{
  "packages": [
    {
      "current_version": "2.4.0",
      "deprecation": {
        "is_deprecated": true,
        "kind": "yanked"
      },
      "ecosystem": "pypi",
      "latest_version": "2.5.4",
      "license": {
        "expression": "0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib",
        "risk": "permissive"
      },
      "max_severity": null,
      "name": "numpy",
      "notes": [
        "YANKED"
      ],
      "status": "deprecated",
      "update_type": "minor",
      "upgrade_to": null,
      "vulnerability_count": 0
    },
    {
      "current_version": "3.0.0",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "pypi",
      "latest_version": "4.1.3",
      "license": {
        "expression": "GPL-2.0-or-later",
        "risk": "strong_copyleft"
      },
      "max_severity": null,
      "name": "pylint",
      "notes": [
        "LICENSE_POLICY"
      ],
      "status": "ok",
      "update_type": "major",
      "upgrade_to": null,
      "vulnerability_count": 0
    },
    {
      "current_version": null,
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "pypi",
      "latest_version": "2.34.2",
      "license": {
        "expression": "Apache-2.0",
        "risk": "permissive"
      },
      "max_severity": null,
      "name": "requests",
      "notes": [
        "UNPINNED"
      ],
      "status": "ok",
      "update_type": "unknown",
      "upgrade_to": null,
      "vulnerability_count": 0
    }
  ],
  "summary": {
    "deprecated": 1,
    "not_found": 0,
    "ok": 2,
    "skipped": 0,
    "total": 3,
    "unverifiable": 0,
    "vulnerable": 0
  },
  "verdict": "FAIL"
}

Cargo.lock with Korean notes

# crates# rust# korean

Rust lockfile: workspace crates without a registry source are skipped, registry crates are checked. lang=ko returns Korean notes. (snapshot 2026-10-21, output abridged)

📥 Input

{
  "lang": "ko",
  "lockfile": "# This file is automatically @generated by Cargo.\n# It is not intended for manual editing.\nversion = 3\n\n[[package]]\nname = \"demo\"\nversion = \"0.1.0\"\ndependencies = [\n \"time\",\n]\n\n[[package]]\nname = \"time\"\nversion = \"0.1.43\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"ca8a50ef2360fbd1eeb0ecd46795a87a19024eb4b53c5dc916ca1fd95fe62438\"\n",
  "lockfile_name": "Cargo.lock",
  "sbom": false
}

📤 Output

{
  "packages": [
    {
      "current_version": "0.1.0",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "crates",
      "latest_version": null,
      "license": {
        "expression": null,
        "risk": "unknown"
      },
      "max_severity": null,
      "name": "demo",
      "notes": [
        "PRIVATE_REGISTRY_SKIPPED"
      ],
      "status": "skipped",
      "update_type": "unknown",
      "upgrade_to": null,
      "vulnerability_count": 0
    },
    {
      "current_version": "0.1.43",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "crates",
      "latest_version": "0.3.55",
      "license": {
        "expression": "Apache-2.0 OR MIT",
        "risk": "permissive"
      },
      "max_severity": "MEDIUM",
      "name": "time",
      "notes": [
        "VULNERABLE"
      ],
      "status": "vulnerable",
      "update_type": "minor",
      "upgrade_to": "0.2.0",
      "vulnerabilities": [
        {
          "fixed_in": [
            "0.2.0",
            "0.2.1"
          ],
          "id": "GHSA-wcg3-cvx6-7396",
          "severity": "MEDIUM",
          "summary": "Segmentation fault in time"
        }
      ],
      "vulnerability_count": 1
    }
  ],
  "summary": {
    "deprecated": 0,
    "not_found": 0,
    "ok": 0,
    "skipped": 1,
    "total": 2,
    "unverifiable": 0,
    "vulnerable": 1
  },
  "upgrades": [
    {
      "from": "0.1.43",
      "name": "time",
      "to": "0.2.0"
    }
  ],
  "verdict": "WARN"
}

Maven, Go and NuGet through deps.dev

# maven# go# nuget

Ecosystems without a native adapter use deps.dev for latest version and license, and OSV for advisories. (snapshot 2026-10-21, output abridged)

📥 Input

{
  "packages": [
    "maven:org.apache.logging.log4j:log4j-core@2.14.1",
    "go:github.com/gin-gonic/gin@v1.6.0",
    "nuget:Newtonsoft.Json@12.0.1"
  ],
  "sbom": false
}

📤 Output

{
  "packages": [
    {
      "current_version": "2.14.1",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "maven",
      "latest_version": "2.26.1",
      "license": {
        "expression": "Apache-2.0",
        "risk": "permissive"
      },
      "max_severity": "CRITICAL",
      "name": "org.apache.logging.log4j:log4j-core",
      "notes": [
        "VULNERABLE"
      ],
      "status": "vulnerable",
      "update_type": "minor",
      "upgrade_to": "2.25.4",
      "vulnerabilities": [
        {
          "fixed_in": [
            "2.3.1",
            "2.12.2"
          ],
          "id": "GHSA-7rjr-3q55-vv33",
          "severity": "CRITICAL",
          "summary": "Incomplete fix for Apache Log4j vulnerability"
        },
        {
          "fixed_in": [
            "2.3.1",
            "2.12.2"
          ],
          "id": "GHSA-jfh8-c2jp-5v3q",
          "severity": "CRITICAL",
          "summary": "Remote code injection in Log4j"
        }
      ],
      "vulnerability_count": 7
    },
    {
      "current_version": "v1.6.0",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "go",
      "latest_version": "v1.12.0",
      "license": {
        "expression": "MIT",
        "risk": "permissive"
      },
      "max_severity": "HIGH",
      "name": "github.com/gin-gonic/gin",
      "notes": [
        "VULNERABLE"
      ],
      "status": "vulnerable",
      "update_type": "minor",
      "upgrade_to": "1.9.1",
      "vulnerabilities": [
        {
          "fixed_in": [
            "1.7.7"
          ],
          "id": "GHSA-h395-qcrw-5vmq",
          "severity": "HIGH",
          "summary": "Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin"
        },
        {
          "fixed_in": [
            "1.9.1"
          ],
          "id": "GHSA-2c4m-59x9-fr2g",
          "severity": "MEDIUM",
          "summary": "Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment "
        }
      ],
      "vulnerability_count": 3
    },
    {
      "current_version": "12.0.1",
      "deprecation": {
        "is_deprecated": false,
        "kind": null
      },
      "ecosystem": "nuget",
      "latest_version": "13.0.4",
      "license": {
        "expression": "MIT",
        "risk": "permissive"
      },
      "max_severity": "HIGH",
      "name": "Newtonsoft.Json",
      "notes": [
        "VULNERABLE"
      ],
      "status": "vulnerable",
      "update_type": "major",
      "upgrade_to": "13.0.1",
      "vulnerabilities": [
        {
          "fixed_in": [
            "13.0.1"
          ],
          "id": "GHSA-5crp-9r3c-p9vr",
          "severity": "HIGH",
          "summary": "Improper Handling of Exceptional Conditions in Newtonsoft.Json"
        }
      ],
      "vulnerability_count": 1
    }
  ],
  "summary": {
    "deprecated": 0,
    "not_found": 0,
    "ok": 0,
    "skipped": 0,
    "total": 3,
    "unverifiable": 0,
    "vulnerable": 3
  },
  "upgrades": [
    {
      "from": "v1.6.0",
      "name": "github.com/gin-gonic/gin",
      "to": "1.9.1"
    },
    {
      "from": "2.14.1",
      "name": "org.apache.logging.log4j:log4j-core",
      "to": "2.25.4"
    },
    {
      "from": "12.0.1",
      "name": "Newtonsoft.Json",
      "to": "13.0.1"
    }
  ],
  "verdict": "FAIL"
}

All examples are also available via the agent API: /v1/agent/skills/ca1d8589-ef90-42bb-80d9-efd09fb2f065/schema

Reviews & Ratings

No reviews yet. Be the first to leave one!

✍️ Write a Review

Nickname * Rating * Comment (optional)