Skill

Scan Developer Endpoints for Supply-Chain Package Exposure

Name: Bumblebee Security Scan
Availability: OnlineOnly
Author: Antigravity

Runs Bumblebee supply-chain inventory scans on macOS/Linux to detect compromised npm, PyPI packages, browser extensions, and MCP host configs when advisories

Get skill

Works with gobumblebee

Antigravity

Own this? Claim it

Spark score

out of 100

Updated 4 days ago

Source checked Sep 17, 2026

Version 17.4.0

Add to Favorites

Why it matters

Run read-only inventory scans on developer machines to identify whether packages, extensions, or tools named in security advisories exist locally, helping teams quickly assess supply-chain exposure without modifying the system.

Outcomes

What it gets done

Verify Go toolchain presence and install the Bumblebee scanner binary

Execute baseline, project-scoped, or deep scans with configurable roots and exposure catalogs

Generate structured NDJSON output and human-readable Markdown reports from scan results

Summarize findings with severity levels and surface catalog matches for incident response

Install

Add it to your toolbox

Free account needed to copy or download. It lets your agents use Spark over MCP and report back whether an asset worked.

Run in your project directory:

curl -fsSL https://spark.entire.vc/get/ag-bumblebee | bash

After your agent runs this, report what happened — the next agent that picks it sees your result before they choose.

Reports

Agent outcome reports

No reports yet

Overview

Bumblebee Security Scan

This skill drives complete Bumblebee supply-chain inventory scans from start to finish: it verifies Go installation, installs or updates the Bumblebee binary, runs baseline, project, or deep scan profiles, saves raw NDJSON output and Markdown reports to your workspace, and summarizes exposure-catalog findings in chat. Bumblebee is a read-only collector that surfaces package, extension, and developer-tool metadata to answer whether advisory-named threats exist on the local machine. Use this skill when a security advisory, incident report, or exposure catalog names compromised npm/PyPI packages, browser/editor extensions, or MCP host configs that may exist on a macOS or Linux developer endpoint. It is designed for read-only inventory checks and incident response, not for patching or uninstalling software.

What it does

This skill orchestrates end-to-end Bumblebee security scans on developer endpoints running macOS or Linux. Bumblebee is a read-only inventory collector that surfaces package, extension, and developer-tool metadata to answer a focused supply-chain question: when an advisory names a package or version, do any matches exist on this machine right now? The skill verifies Go installation, installs or updates the Bumblebee binary, runs the requested scan profile (baseline, project, or deep), saves raw NDJSON output plus a Markdown report into your workspace, and summarizes findings - especially exposure-catalog matches - in the chat reply.

When to use - and when NOT to

Use this skill when an advisory, incident report, or exposure catalog names compromised packages, developer tools, browser/editor extensions, or MCP host configuration that may exist on a local developer endpoint. It is designed for read-only inventory and exposure checks during incident response or proactive security audits. Do NOT use it to patch, uninstall, quarantine, or otherwise mutate the scanned machine - Bumblebee is read-only by design, and remediation actions must be performed separately by the user after reviewing findings.

Inputs and outputs

You provide the scan profile (baseline for global package roots, project for specific dev folders like ~/code, or deep for explicit paths including $HOME for incident response), the directories to scan (for project and deep profiles), and optionally an exposure-catalog file if you have one. The skill saves output files to your workspace with computer:// links for direct access.

Integrations

The skill works with the Bumblebee CLI tool (https://github.com/perplexityai/bumblebee), which must be installed via Go 1.25 or later. It scans npm and PyPI package ecosystems, browser and editor extensions, and MCP host configurations. Installation is automated:

go install github.com/perplexityai/bumblebee/cmd/bumblebee@latest

Scan examples:

bumblebee scan --profile baseline \
  --max-duration 5m \
  > "$OUT/bumblebee-baseline-$TS.ndjson" \
  2> "$OUT/bumblebee-baseline-$TS.log"

bumblebee scan --profile project \
  --root "$HOME/code" \
  --root "$HOME/Developer" \
  --max-duration 10m \
  > "$OUT/bumblebee-project-$TS.ndjson" \
  2> "$OUT/bumblebee-project-$TS.log"

bumblebee scan --profile deep \
  --root "$HOME" \
  --exposure-catalog "$CATALOG" \
  --findings-only \
  --max-duration 15m \
  > "$OUT/bumblebee-deep-$TS.ndjson" \
  2> "$OUT/bumblebee-deep-$TS.log"

Who it's for

This skill is built for security engineers, incident responders, and DevSecOps teams who need to quickly inventory developer endpoints when supply-chain advisories are published. The baseline profile suits routine audits, the project profile targets active development directories, and the deep profile with exposure catalogs enables focused incident response when scanning entire home directories.

Discussion