bumblebee
Run Bumblebee supply-chain inventory and exposure scans on macOS/Linux to detect compromised packages, extensions, and MCP host configs.
newIT & Software DevelopmentOperations & Supply ChainSecurityincident-responsenpmpypisecuritysupply-chaintooling
Bumblebee Security Scan
Bumblebee (https://github.com/perplexityai/bumblebee) is a read-only inventory collector that surfaces package, extension, and developer-tool metadata on developer endpoints. It answers a focused supply-chain question: when an advisory names a package or version, do any matches exist on this machine right now?
This skill drives a single Bumblebee scan from start to finish:
- Verify Go is on the PATH (provide install guidance if not).
- Verify or install the
bumblebeebinary. - Run the requested scan profile (
baseline,project, ordeep). - Save raw NDJSON output plus a Markdown report into the user's workspace.
- Summarize findings — especially exposure-catalog matches — in the chat reply.
Communicate with the user in the language they used (German for Stefan). Code, commit messages, and on-disk file contents stay in English to match existing project conventions.
When to Use This Skill
Use this skill when an advisory, incident report, or exposure catalog names compromised packages, developer tools, browser/editor extensions, or MCP host configuration that may exist on a local macOS or Linux developer endpoint.
Use it for read-only inventory and exposure checks. Do not use it to patch, uninstall, quarantine, or otherwise mutate the scanned machine.
Step 1 — Clarify the scan request
Before running anything, confirm two things
Subscribers only
The full skill, its 2 bundled files and every download is included with every paid Complete AI plan.
Details
| Source | mycelos-ai/bumblebee-skill |
|---|---|
| License | MIT |
| Risk label | safe ("critical" means the skill may run commands or touch files — read before use) |
| Files | SKILL.md, scripts/render_report.py |
| Added | 2026-05-27 |
Related skills
007
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
active-directory-attacks
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
anti-reversing-techniques
AUTHORIZED USE ONLY: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis: > 1.
attack-tree-construction
Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
audit-skills
Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).
auth-implementation-patterns
Implement or review authentication and authorization with explicit token, session and resource-access boundaries.