bumblebee
Run Bumblebee supply-chain inventory and exposure scans on macOS/Linux to detect compromised packages, extensions, and MCP host configs.
Profile →npx skills add sickn33/agentic-awesome-skills --skill bumblebee --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Bumblebee Security Scan Bumblebee (https://github.com/perplexityai/bumblebee) is a read-only inventory collector that surfaces package, extension, and developer-tool metadata on developer endpoints. It answers a focused supply-chain question: when an advisory names a package or version, do any matches exist on this machine right now? This skill drives a single Bumblebee scan from start to finish: 1. Verify Go is on the PATH (provide install guidance if not). 2. Verify or install the `bumblebee` binary. 3. Run the requested scan profile (`baseline`, `project`, or `deep`). 4. Save raw NDJSON output plus a Markdown report into the user's workspace. 5. Summarize findings — especially exposure-catalog matches — in the chat reply. Communicate with the user in the language they used (German for Stefan). Code, commit messages, and on-disk file contents stay in English to match existing project conventions. ## When to Use This Skill Use this skill when an advisory, incident report, or exposure catalog names compromised packages, developer tools, browser/editor extensions, or MCP host configuration that may exist on a local macOS or Linux developer endpoint. Use it for read-only inventory
- When to Use This Skill
- Step 1 — Clarify the scan request
- Step 2 — Check Go
- Step 3 — Check or install Bumblebee
- Step 4 — Run the scan
- Baseline
- Project
- Deep
- Step 5 — Generate the Markdown report
- Step 6 — Present results
- Safety and privacy notes
- Failure modes to watch for
- Limitations
- Reference
go install github.com/perplexityai/bumblebee/cmd/bumblebee@latest bumblebee scan --profile baseline \ bumblebee scan --profile baseline --ecosystem npm,pypi ... bumblebee scan --profile project \ bumblebee scan --profile deep \ test -f "$BUMBLEBEE_SKILL_DIR/scripts/render_report.py" python3 "$BUMBLEBEE_SKILL_DIR/scripts/render_report.py" \
What does the bumblebee skill do?
Run Bumblebee supply-chain inventory and exposure scans on macOS/Linux to detect compromised packages, extensions, and MCP host configs.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill bumblebee --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.