Update to NPMScan

{
  "canonical_app_id": "asdk_app_6a6a699e6f3481918d5e6034432894f2",
  "connector_id": "asdk_app_6a6a699e6f3481918d5e6034432894f2",
  "created_at": "2026-07-29T20:59:10.652584Z",
  "discoverability": "LISTED",
  "id": "plugin_asdk_app_6a6a699e6f3481918d5e6034432894f2",
  "is_template": false,
  "is_template_instance": false,
  "is_v2_template": false,
  "name": "app-6a6a699e6f3481918d5e6034432894f2",
  "release": {
    "app_ids": [
      "asdk_app_6a6a699e6f3481918d5e6034432894f2"
    ],
    "app_manifest": {
      "apps": {
        "app-6a6a699e6f3481918d5e6034432894f2": {
          "id": "asdk_app_6a6a699e6f3481918d5e6034432894f2",
          "required": true
        }
      }
    },
    "app_templates": [],
    "description": "Look up npm package metadata, known vulnerabilities, and CVE details directly from a conversation. NPMScan's MCP server gives AI agents read-only tools backed by the npm registry, OSV.dev, GitHub Security Advisories, GitHub's own API, and the NIST National Vulnerability Database: search packages by name or keyword with download counts, dependent-package counts, and typosquat detection on every result; inspect a package's install scripts, maintainers, license, GitHub stars, and download trend before installing, or compare 2-5 candidates side-by-side with a deterministic pick; check an exact version pinned in a lockfile, or simulate upgrading one before running npm install to see if it's a safe patch or a likely-breaking major bump; query vulnerabilities for one package or up to 100 at once, each finding enriched with severity, a summary, CVE aliases, and the fixed version rather than a bare advisory ID; audit an entire GitHub repository's dependencies (including monorepo workspaces) in one call, or generate a spec-valid CycloneDX/SPDX SBOM with vulnerability and license data embedded; rank the findings from a raw `npm audit --json` report by CISA KEV/FIRST EPSS exploitation data to know what to fix first, then pull the concrete, ordered remediation playbook for a flagged finding; check an npm maintainer account's publish history for a compromised-account-style cluster, or pull their basic profile; browse the latest npm advisories from either GitHub's curated, mostly CVE-backed reviewed set or its known-malicious-package malware feed, filterable by severity, vulnerability category (XSS, SQL/NoSQL Injection, SSRF, Access Control, Code Injection, and 15 more, reviewed only), affected package, or an exact GHSA/CVE ID; and look up authoritative CVSS/CWE data for any CVE across any ecosystem, enriched with CISA's Known Exploited Vulnerabilities status and FIRST.org's EPSS exploitation-probability score. No API key or authentication is required, and every result links back to the full write-up on npmscan.com.",
    "display_name": "NPMScan",
    "id": "pluginrel_1e35db74309c81918693771d0841da81",
    "interface": {
      "brand_color": null,
      "capabilities": [],
      "category": "Developer Tools",
      "composer_icon_dark_url": "https://files.openai.com/content?id=file_00000000620481f4902f42d39eff7d12",
      "composer_icon_url": "https://files.openai.com/content?id=file_000000004a3481f4940425585a62fda1",
      "default_prompt": "Find npm packages for parsing CSV files",
      "default_prompts": [
        "Find npm packages for parsing CSV files",
        "Is minimist 1.2.5 safe to use, or do I need to upgrade?",
        "Audit my package.json dependencies for vulnerabilities and risky install scripts"
      ],
      "developer_name": "SHYNGYS SHYNBOLATOV",
      "logo_url": "https://files.openai.com/content?id=file_0000000063f882468dd752086f6c99a7",
      "logo_url_dark": "https://files.openai.com/content?id=file_00000000630c8243aee15c270c53c093",
      "long_description": "Look up npm package metadata, known vulnerabilities, and CVE details directly from a conversation. NPMScan's MCP server gives AI agents read-only tools backed by the npm registry, OSV.dev, GitHub Security Advisories, GitHub's own API, and the NIST National Vulnerability Database: search packages by name or keyword with download counts, dependent-package counts, and typosquat detection on every result; inspect a package's install scripts, maintainers, license, GitHub stars, and download trend before installing, or compare 2-5 candidates side-by-side with a deterministic pick; check an exact version pinned in a lockfile, or simulate upgrading one before running npm install to see if it's a safe patch or a likely-breaking major bump; query vulnerabilities for one package or up to 100 at once, each finding enriched with severity, a summary, CVE aliases, and the fixed version rather than a bare advisory ID; audit an entire GitHub repository's dependencies (including monorepo workspaces) in one call, or generate a spec-valid CycloneDX/SPDX SBOM with vulnerability and license data embedded; rank the findings from a raw `npm audit --json` report by CISA KEV/FIRST EPSS exploitation data to know what to fix first, then pull the concrete, ordered remediation playbook for a flagged finding; check an npm maintainer account's publish history for a compromised-account-style cluster, or pull their basic profile; browse the latest npm advisories from either GitHub's curated, mostly CVE-backed reviewed set or its known-malicious-package malware feed, filterable by severity, vulnerability category (XSS, SQL/NoSQL Injection, SSRF, Access Control, Code Injection, and 15 more, reviewed only), affected package, or an exact GHSA/CVE ID; and look up authoritative CVSS/CWE data for any CVE across any ecosystem, enriched with CISA's Known Exploited Vulnerabilities status and FIRST.org's EPSS exploitation-probability score. No API key or authentication is required, and every result links back to the full write-up on npmscan.com.",
      "plugin_category_id": "developer tools",
      "privacy_policy_url": "https://npmscan.com/privacy",
      "screenshot_urls": [],
      "short_description": "npm package & vuln lookups",
      "terms_of_service_url": "https://npmscan.com/terms",
      "website_url": "https://npmscan.com/"
    },
    "keywords": [],
    "mcp_servers": [],
    "onboarding_skill_name": null,
    "requires_local_executor": false,
    "skills": [
      {
        "description": "Turn a dependency change — a before/after package.json/lockfile snapshot, or one or more named \"bump X from A to B\" upgrades — into one deterministic PASS/WARN/FAIL verdict formatted for a CI check or PR-comment bot, not a conversational report. Use when the user explicitly wants a mergeable/blocking verdict, a \"CI gate,\" a PR status comment, or asks \"should this PR be blocked,\" \"is this safe to merge,\" \"gate this dependency bump.\" Not for a plain explanation of what changed in a diff (dependency-audit's own snapshot-diff flow already covers that conversationally) and not for a single already-installed package's trust investigation (package-trust-check).",
        "interface": {
          "brand_color": null,
          "default_prompt": null,
          "display_name": "ci-pr-gate",
          "icon_large_url": null,
          "icon_small_url": null,
          "iconography": "code",
          "short_description": "Turn a dependency change — a before/after package.json/lockfile snapshot, or one or more named \"bump X from A to B\" upgrades — into one deterministic PASS/WARN/FAIL verdict formatted for a CI check or PR-comment bot, not a conversational report. Use when the user explicitly wants a mergeable/blocking verdict, a \"CI gate,\" a PR status comment, or asks \"should this PR be blocked,\" \"is this safe to merge,\" \"gate this dependency bump.\" Not for a plain explanation of what changed in a diff (dependency-audit's own snapshot-diff flow already covers that conversationally) and not for a single already-installed package's trust investigation (package-trust-check)."
        },
        "name": "ci-pr-gate",
        "plugin_release_skill_id": "pluginrsk_6aa8829ab7cc8191937c29d6b3021817"
      },
      {
        "description": "Audit a project's npm dependencies for known vulnerabilities and risky install scripts before installing, upgrading, or shipping. Use when the user pastes or attaches a package.json/lockfile, lists dependencies, or asks to check/audit/scan their packages for security issues — including comparing two snapshots (a PR diff) or checking license compliance.",
        "interface": {
          "brand_color": null,
          "default_prompt": null,
          "display_name": "dependency-audit",
          "icon_large_url": null,
          "icon_small_url": null,
          "iconography": "radar",
          "short_description": "Audit a project's npm dependencies for known vulnerabilities and risky install scripts before installing, upgrading, or shipping. Use when the user pastes or attaches a package.json/lockfile, lists dependencies, or asks to check/audit/scan their packages for security issues — including comparing two snapshots (a PR diff) or checking license compliance."
        },
        "name": "dependency-audit",
        "plugin_release_skill_id": "pluginrsk_6aa8825150e481919b1acdd51722c07e"
      },
      {
        "description": "Turn a flagged npm supply-chain finding — or just a vague, non-technical description of one (\"this package looks sketchy,\" \"someone said we got hacked,\" \"npm install did something weird\") — into concrete remediation steps. Use whenever the user wants to know what to actually do about a suspicious/compromised/flagged package, however precisely or vaguely they describe it — not for the initial trust/vulnerability investigation itself (see package-trust-check/dependency-audit for that).",
        "interface": {
          "brand_color": null,
          "default_prompt": null,
          "display_name": "incident-response",
          "icon_large_url": null,
          "icon_small_url": null,
          "iconography": "bolt",
          "short_description": "Turn a flagged npm supply-chain finding — or just a vague, non-technical description of one (\"this package looks sketchy,\" \"someone said we got hacked,\" \"npm install did something weird\") — into concrete remediation steps. Use whenever the user wants to know what to actually do about a suspicious/compromised/flagged package, however precisely or vaguely they describe it — not for the initial trust/vulnerability investigation itself (see package-trust-check/dependency-audit for that)."
        },
        "name": "incident-response",
        "plugin_release_skill_id": "pluginrsk_6aa8825cc83881919643e10ecddf1b44"
      },
      {
        "description": "Help decide what to add as a NEW npm dependency — comparing 2-5 named candidates for the same job, evaluating one named candidate against its real peers, or shortlisting candidates from a described need, before anything is installed. Use for \"which should we use for X,\" \"axios vs got vs node-fetch,\" \"is X a good pick for Y,\" \"what should we use to do Z,\" \"should we add X or is there something better.\" Not for auditing packages already in the project (see dependency-audit), not for a deep single-package compromise/trust investigation (see package-trust-check), and not for a plain factual question with no choice being made (\"what does X do\").",
        "interface": {
          "brand_color": null,
          "default_prompt": null,
          "display_name": "new-dependency-evaluation",
          "icon_large_url": null,
          "icon_small_url": null,
          "iconography": "heart",
          "short_description": "Help decide what to add as a NEW npm dependency — comparing 2-5 named candidates for the same job, evaluating one named candidate against its real peers, or shortlisting candidates from a described need, before anything is installed. Use for \"which should we use for X,\" \"axios vs got vs node-fetch,\" \"is X a good pick for Y,\" \"what should we use to do Z,\" \"should we add X or is there something better.\" Not for auditing packages already in the project (see dependency-audit), not for a deep single-package compromise/trust investigation (see package-trust-check), and not for a plain factual question with no choice being made (\"what does X do\")."
        },
        "name": "new-dependency-evaluation",
        "plugin_release_skill_id": "pluginrsk_6aa882a41b3481918b3b93986c8d4a7a"
      },
      {
        "description": "Investigate whether one specific npm package is trustworthy — maintainer/ownership takeover signals, publish-provenance mismatches, and risky install scripts. Use when the user asks if a single named package is safe, compromised, hijacked, suspicious, or \"can I trust this\" — not for auditing a full package.json/lockfile (see dependency-audit) and not for a plain factual question like \"what does X do.\"",
        "interface": {
          "brand_color": null,
          "default_prompt": null,
          "display_name": "package-trust-check",
          "icon_large_url": null,
          "icon_small_url": null,
          "iconography": "hierarchy",
          "short_description": "Investigate whether one specific npm package is trustworthy — maintainer/ownership takeover signals, publish-provenance mismatches, and risky install scripts. Use when the user asks if a single named package is safe, compromised, hijacked, suspicious, or \"can I trust this\" — not for auditing a full package.json/lockfile (see dependency-audit) and not for a plain factual question like \"what does X do.\""
        },
        "name": "package-trust-check",
        "plugin_release_skill_id": "pluginrsk_6aa882a7264c8191a5daa9e688e5e052"
      }
    ],
    "version": "3.0.0"
  },
  "scope": "GLOBAL",
  "share_url": "https://chatgpt.com/plugins/plugin_asdk_app_6a6a699e6f3481918d5e6034432894f2?open_in_app",
  "status": "ENABLED"
}