Scan Developer Endpoints for Supply-Chain Package Exposure

Bumblebee Security Scan drives a single run of Bumblebee, a read-only supply-chain inventory collector, end to end on macOS or Linux. Bumblebee answers a focused question: when an advisory names a compromised package or version, do any matches exist on this machine right now, across packages, extensions, developer tools and MCP host configs? The skill's five steps: verify Go is on PATH, verify or install the bumblebee binary, run the requested scan profile, save raw NDJSON output plus a Markdown report into the user's workspace, and summarize findings - especially exposure-catalog matches - in the chat reply.

Before running anything, it confirms the scan profile and roots with the user via AskUserQuestion, unless already stated: baseline scans global package roots, project scans named directories like ~/code, and deep accepts explicit --root paths including a bare $HOME for incident response - only deep accepts that bare-home root; project and baseline both reject it. It checks Go with command -v go && go version, requiring 1.25+, and never installs Go automatically - it shows platform-specific instructions (Homebrew on macOS, the official tarball preferred over distro packages on Debian/Ubuntu, dnf or the tarball on Fedora/RHEL) and stops until the user upgrades. It checks or installs Bumblebee with go install github.com/perplexityai/bumblebee/cmd/bumblebee@latest, then runs bumblebee selftest as a sanity check, refusing to proceed on a non-zero exit.

Each scan writes NDJSON and a sibling .log diagnostic stream to files named bumblebee-<profile>-<UTC-timestamp>.ndjson/.log, bounded by a --max-duration default of 5m for baseline, 10m for project and 15m for deep:

bumblebee scan --profile baseline \
  --max-duration 5m \
  > "$OUT/bumblebee-baseline-$TS.ndjson" \
  2> "$OUT/bumblebee-baseline-$TS.log"

The deep profile pairs broad roots with --exposure-catalog and --findings-only whenever possible to keep output focused, warning the user that an unscoped deep scan's NDJSON can grow to hundreds of MB. A bundled, dependency-free scripts/render_report.py - resolved from the installed skill directory, never run workspace-relatively - turns the NDJSON into a Markdown report grouped by record type and ecosystem, sorted findings by severity (critical first), and an embedded scan_summary for traceability; a non-zero exit from the renderer surfaces stderr instead of producing a silently empty report. The final chat reply states the profile, roots, record counts and any findings with severity explicitly - including explicitly stating zero findings rather than staying silent - plus computer:// links to both output files, never pasting large NDJSON chunks into chat.

Use it when an advisory, incident report or exposure catalog names compromised packages, developer tools, browser/editor extensions or MCP host configuration that may exist on a local macOS or Linux developer endpoint, for read-only inventory and exposure checks. Do not use it to patch, uninstall, quarantine or otherwise mutate the scanned machine - the user runs any remediation themselves once they know what is affected. Its safety notes: MCP host configs can carry secrets in env blocks, and though Bumblebee does not emit those values, .log files may still reference sensitive config paths, so output files should not be uploaded to third-party services without the user's explicit consent; and bumblebee must never run with elevated privileges (sudo), since it inspects the current user's developer environment, not the whole system.

Input is the scan profile, target roots, and optionally an exposure-catalog JSON file (with required schema_version and entries keys). Output is a raw NDJSON scan file, a .log diagnostic stream, and a rendered Markdown report grouping inventory by ecosystem/root-kind/confidence and listing every finding with its catalog entry and severity.

It wraps the official bumblebee CLI (github.com/perplexityai/bumblebee, Apache-2.0) built via go install, and is itself an MIT-licensed thin skill wrapper around that project.

It suits developers and incident responders who need to quickly check whether a named compromised package, extension or MCP config actually exists on their own machine, without any risk of the scan itself modifying the system.