domains / security / codebase-and-supply-chain-scan / scan

scan

Skill card

combined

The two skills share the name 'scan' but perform fundamentally different tasks. The first is a lightweight codebase assessment tool that produces planning documents in .planning/codebase/ using a specific workflow file. The second is a supply chain security scanner (agent-bom) that checks packages for CVEs, scans container images, and generates SBOMs. They do not overlap in procedure, tools, or output, so crowning one would hide a real alternative.

Repositories

Other copies

Combined skill

# Scan

This skill covers two distinct scanning tasks. Determine which one the user intends.

## 1. Codebase Assessment (gsd:scan)

Use when the user asks for a codebase scan, assessment, or mapping of a specific area.

1. Accept an optional `--focus` flag: `tech`, `arch`, `quality`, `concerns`, or `tech+arch` (default).
2. Execute the scan workflow from `@${CLAUDE_PLUGIN_ROOT}/workflows/scan.md` end-to-end.
3. Produce targeted documents in `.planning/codebase/`.
4. This is a lightweight alternative to `/gsd:map-codebase` — it spawns one mapper agent instead of four parallel ones.

## 2. Supply Chain Security Scan (agent-bom-scan)

Use when the user asks to check a package, scan an image, verify provenance, look up CVEs, or generate an SBOM.

1. Ensure `agent-bom` is installed (`pipx install agent-bom`).
2. Run the appropriate command:
   - `agent-bom check <package>==<version>` — check a specific package for CVEs (OSV, NVD, EPSS, KEV).
   - `agent-bom image <image>` — scan a container image natively.
   - `agent-bom fs <path>` — scan filesystem packages.
   - `agent-bom sbom <path>` — generate an SBOM.
   - `agent-bom verify <package>` — verify Sigstore provenance.
   - `agent-bom agents` — discover agents and scan dependencies.
   - `agent-bom scan` — full discovery + vulnerability scan pipeline.
   - `agent-bom blast_radius` — map CVE impact chain across agents, servers, credentials.
3. All scanning is local-first. Only public package names and CVE IDs are sent to vulnerability databases.
4. No credentials are required for basic operation.

## Conflicts

- davepoon/buildwithclaude: The scan produces planning documents in `.planning/codebase/` and uses a mapper agent workflow.
- LeoYeAI/openclaw-master-skills: The scan checks packages for CVEs, scans container images, and generates SBOMs using the agent-bom CLI.

These are unrelated tasks that happen to share the name 'scan'.