Agent skill · security · sickn33
bumblebee
Run Bumblebee supply-chain inventory and exposure scans on macOS/Linux to detect compromised packages, extensions, and MCP host configs.
Why this skill is useful
Adds specific commands and workflows for running Bumblebee scans that the AI wouldn't reliably generate on its own.
What it needs
Requires go installed locally. About 6k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
Bumblebee Security Scan Bumblebee (https://github.com/perplexityai/bumblebee) is a read-only inventory collector that surfaces package, extension, and developer-tool metadata on developer endpoints. It answers a focused supply-chain question: when an advisory names a package or version, do any matches exist on this machine right now? This skill drives a single Bumblebee scan from start to finish: 1. Verify Go is on the PATH (provide install guidance if not). 2. Verify or install the bumblebee binary. 3. Run the requested scan profile (baseline, project, or deep). 4. Save raw NDJSON output plus a Markdown report into the user's workspace. 5. Summarize findings — especially exposure-catalog matches — in the chat reply. Communicate with the user in the language they used (German for Stefan). Code, commit messages, and on-disk file contents stay in English to match existing project conventions. When to Use This Skill Use this skill when an advisory, incident report, or exposure catalog names compromised packages, developer tools, browser/editor extensions, or MCP host configuration that may exist on a local macOS or Linux developer endpoint. Use it for read-only inventory and exposure checks. Do not use it to patch, uninstall, quarantine, or otherwise mutate the scanned machine. Step 1 — Clarify the scan request Before running anything, confirm two things with the user via AskUserQuestion, unless the message already pins them down: Profile: baseline (global package roots), project (specific dev folders like ~/code), or deep (explicit --root paths, including $HOME for incident response). Roots: For project and deep profiles, ask which directories to scan. deep is the only profile that accepts a bare-home root. If the user has an advisory or exposure-catalog file ready, also ask whether they want to pass it via --exposure-catalog. The skill does not ship its own catalogs — point them at threatintel/ in the Bumblebee repo if they ask where to find ready-made ones. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/bumblebee--583eef