/red-team
Runs osv-scanner on lockfiles, traces reachability with rg and ast-grep, optionally enriches via gh, and records every advisory across five explicit triage states.
npx skills@latest add luci-efe/skills -s red-team- ProveStage
- 03 Evidence of doneMethod
- .ramos/
red-team/ report.md · .ramos/ red-team/ osv.jsonProduced artifact / output
Use when
Dependencies or lockfiles changed, an advisory or CVE landed, or before a release.
Support & adapters
- Instructions usable across harnesses
Decision tree
- 01→ .ramos/
1. Lockfile scan (osv-scanner)
Run osv-scanner scan source -r --format json --output-file .ramos/
red-team/ osv.json . (exit 0 clean, exit 1 vulns, exit 128/ other = unknown) red-team/ osv.json - 02→ not affected (version) | not found within stated coverage | suspected
2. Triage reachability (rg + ast-grep)
Check resolved lockfile version, then trace imports/
calls with rg -n and ast-grep run -p; optionally enrich via gh api - 03→ .ramos/
3–4. Local reproduction & minimal fix
Write a failing test in the repo suite against a local checkout to confirm exploit, then bump via osv-scanner fix and hand to /
proof red-team/ report.md
Prerequisites & install recipes
- osv-scannerrequired · scan & github-enrich branches
osv-scannerbrew install osv-scanner - rgrequired · scan branch
rgbrew install ripgrep - ast-greprequired · scan branch
ast-grepbrew install ast-grep - ghoptional · github-enrich branch
ghbrew install ghOptional read-only Dependabot alert enrichment
Completion criteria
- Lists every advisory in .ramos/
red-team/ report.md as confirmed | suspected | not affected (version) | not found within stated coverage | unknown. - Treats missing lockfiles (exit 128) or scanner errors as unknown, never as a clean bill.
- Reproduces exploits only against a local checkout or owned test environment inside the repo test suite.
Want something like this built for your company?
Book a callMessage me on LinkedInSee Agentic Engineering