domains / families / security / scan

scan

combined

Open security platform for agentic infrastructure — checks packages for CVEs (OSV, NVD, EPSS, KEV), scans container images, verifies provenance, scans filesystems, and generates SBOMs. Use when: "check package", "scan image", "verify", "is this safe", "scan dependencies", "CVE lookup", "blast radius". Rapid codebase assessment — lightweight alternative to /gsd:map-codebase

When to use

• "check package" / "is this package safe"
• "scan image" / "scan container"
• "verify" / "check provenance"
• "is this safe" / "CVE lookup"
• "scan dependencies"
• "blast radius"
• "generate SBOM"

Skill page

Conflict

The two skills share the name 'scan' but perform fundamentally different tasks. The first is a lightweight codebase assessment tool that produces planning documents in .planning/codebase/ using a specific workflow file. The second is a supply chain security scanner (agent-bom) that checks packages for CVEs, scans container images, and generates SBOMs. They do not overlap in procedure, tools, or output, so crowning one would hide a real alternative.