The Claude Code plugin and CLI.

What it is

A Claude Code plugin with one skill, does-this-affect-me. It takes an Advisory, as a GHSA or CVE id, an advisory link, or the pasted text of a post about it, and assesses it against an App in the current repository:

• Is the package in the lockfile, and is the installed version affected?
• Where, if anywhere, is the vulnerable function or feature used?
• Is the config the Advisory depends on enabled?

It ends in a Verdict with file:line evidence. Every deterministic step (finding Apps, parsing lockfiles, matching through OSV, locating usages, checking the Verdict) is done by the agentprime script, which has no dependencies and never runs App or package code.

Set up

You need Node 20 or later and Claude Code. From the repository you want to assess, start Claude Code with the plugin loaded:

claude --plugin-dir /path/to/agentprime

After updating the plugin’s files, run /reload-plugins in the session.

Assess an Advisory

Ask in plain words, like “does CVE-2025-46734 affect us?”, or paste an advisory link. Or run the skill directly:

/agentprime:does-this-affect-me GHSA-xxxx-xxxx-xxxx

Output

The skill writes its Advisory profile to .agentprime/profiles/<id>.json and its Verdict to .agentprime/verdicts/<id>.json in the assessed repository. Add .agentprime/ to that repository’s .gitignore.

A Verdict looks like this (shortened):

{
  "advisory_id": "GHSA-3q6v-r5mr-hxv8",
  "verdict": "not_affected",
  "reason": "No converter the App builds registers the Table extension…",
  "evidence": [
    {
      "file": "app/Http/Controllers/DocsController.php",
      "line": 18,
      "note": "Converts user Markdown with a CommonMarkConverter, whose environment has the core extension only"
    }
  ]
}

The verdict is not_affected, reachable_unproven or inconclusive. Before a Verdict is saved, check confirms the installed version and that every evidence file and line exists.

The CLI

Run the script from the repository root. Each command prints one JSON document.

node /path/to/agentprime/scripts/agentprime.mjs apps
node /path/to/agentprime/scripts/agentprime.mjs inventory --app .
node /path/to/agentprime/scripts/agentprime.mjs match --app . --package league/commonmark
node /path/to/agentprime/scripts/agentprime.mjs advisory GHSA-xxxx-xxxx-xxxx
node /path/to/agentprime/scripts/agentprime.mjs usages league/commonmark --app .
node /path/to/agentprime/scripts/agentprime.mjs check .agentprime/verdicts/GHSA-xxxx-xxxx-xxxx.json --app .

Noise report

The noise report runs the skill once for every open Advisory against an App’s installed dependencies, each in its own headless Claude Code run on your own login, and summarises the Verdicts:

node /path/to/agentprime/scripts/agentprime.mjs report --app . --max-turns 25

It writes .agentprime/report.json with the counts, the cost of the run, and one row per Advisory with its Verdict and reason, and prints a one-paragraph summary like “31 Advisories: 27 Not affected, 3 Inconclusive, 1 Reachable – unproven, and 1 Upgrade to open.” Malicious package entries are listed separately and never assessed.

Stored Verdicts are reused while nothing they depend on has changed: the Advisory’s ranges, the installed version, where the package is used, and every evidence file. Re-running the report only reassesses what changed.