S
ssahmed532/sa-workstation-patch-triage
Claude Code skill: read-only security patch triage for a Windows dev workstation
no SECURITY.md
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · redirects to github.com
Install & config
Client config (built from the install command this repo gives)
{
"mcpServers": {
"ssahmed532-sa-workstation-patch-triage": {
"command": "uvx",
"args": ["pip-audit"]
}
}
}Parsed from the README we fetched on 2026-10-26; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"ssahmed532-sa-workstation-patch-triage": {
"command": "uvx",
"args": ["pip-audit"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio ssahmed532-sa-workstation-patch-triage -- uvx pip-audit
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Star count
- 0 ★ · ssahmed532/sa-workstation-patch-triage · read from the repository page · (checked 2026-11-13 20:00:50)
- Source
- read directly from its GitHub page · type: open-source project
- Harvest history
- first seen 2026-10-22 · last seen 2026-11-14 · seen 27× · listed by 2 sources
- Score
- score 203 · 2 sources · repo
- Install
uvx pip-audit
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
uvx pip-audit. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: 开源项目. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
ssahmed532/sa-workstation-patch-triage；first catalogued 2026-10-22；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.# win-dev-patch-triage
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
A Claude Code skill that runs a read-only security patch triage of a Windows 11 developer workstation and publishes a
ranked remediation page: what to update today, this week, and in the backlog, with a comparison against the previous run.
It checks:
installed apps and browsers (winget, plus file versions for apps winget does not track)
AI agent apps and CLIs: the Claude and ChatGPT desktop apps, and every copy of Claude Code, Codex and OpenCode (native, winget, npm or bun), with the CLIs checked against OSV
language runtimes and toolchains: Node.js, CPython via uv, .NET, Go, PowerShell, Git and others on PATH, plus PHP, Java or Ruby found off PATH
global npm, bun and uv tools, including the libraries bundled inside them (via OSV)
Go-built programs on PATH (gh, lazygit, fzf, ...): the Go version and modules compiled into each, read from the file and checked against OSV
every dependency lockfile under one or more projects folders: uv, pip/requirements, npm, NuGet, Go and Cargo
old copies left installed next to new ones, and commands whose copy in a user folder shadows the system copy
WSL distros (key package versions and how stale the apt lists are), listening ports, and the OS patch level
vendor advisories released in the last N hours (24 by default)
The workflow and its rules are in SKILL.md. The triage rules are in references/triage-rules.md, and the vendor pages checked on each run are in references/vendor-sources.md.
## Requirements
| Tool | Minimum | Used for |
| Windows 11, PowerShell 7 (pwsh) | PowerShell 7.4 (tested with 7.5) | the inventory script |
| uv | a uv that has uv audit (0.13 or newer; tested with 0.13.5). The setup step checks for it and stops with an upgrade message if it is missing | runs the Python scripts and the Python audits (uv audit, uvx pip-audit) |
| Node.js / npm | any current LTS (tested with Node 24) | npm audit and global package checks |
| GitHub CLI (gh), signed in | any | advisory severity and publish dates from the GitHub Advisory Database. Without it, the scripts fall back to OSV |
| .NET SDK | 9.0.300 or newer, the first with dotnet list package --vulnerable (tested with 10.0.402). Older SDKs are noted at setup and .NET projects are not audited | only if projects use .NET |
| Go | any supported release | only if projects use Go; govulncheck. Not needed for checking Go-built programs |
| Claude Code | tested with 2.1.308. Needs background agents; the PowerShell tool is used when present, otherwise Bash | running the skill |
| Claude Code signed in to claude.ai | the Artifact tool | publishing the page. Without it every run is dry and the page is the local file |
## Install
Clone the repo wherever you keep tools, then run the installer from that folder:
powershell
git clone https://github.com/ssahmed532/win-dev-patch-triage
cd win-dev-patch-triage
pwsh -ExecutionPolicy Bypass -File .\install.ps1
install.ps1 links ~/.claude/skills/win-dev-patch-triage to this folder with a directory junction, so the
repo is the only copy and edits are live. It creates no config; the first run does that. Restart Claude Code afterwards.
-ExecutionPolicy Bypass applies to that one command only. Without it, Windows PowerShell 5.1 blocks every script on
ranked remediation page: what to update today, this week, and in the backlog, with a comparison against the previous run.
It checks:
installed apps and browsers (winget, plus file versions for apps winget does not track)
AI agent apps and CLIs: the Claude and ChatGPT desktop apps, and every copy of Claude Code, Codex and OpenCode (native, winget, npm or bun), with the CLIs checked against OSV
language runtimes and toolchains: Node.js, CPython via uv, .NET, Go, PowerShell, Git and others on PATH, plus PHP, Java or Ruby found off PATH
global npm, bun and uv tools, including the libraries bundled inside them (via OSV)
Go-built programs on PATH (gh, lazygit, fzf, ...): the Go version and modules compiled into each, read from the file and checked against OSV
every dependency lockfile under one or more projects folders: uv, pip/requirements, npm, NuGet, Go and Cargo
old copies left installed next to new ones, and commands whose copy in a user folder shadows the system copy
WSL distros (key package versions and how stale the apt lists are), listening ports, and the OS patch level
vendor advisories released in the last N hours (24 by default)
The workflow and its rules are in SKILL.md. The triage rules are in references/triage-rules.md, and the vendor pages checked on each run are in references/vendor-sources.md.
## Requirements
| Tool | Minimum | Used for |
| Windows 11, PowerShell 7 (pwsh) | PowerShell 7.4 (tested with 7.5) | the inventory script |
| uv | a uv that has uv audit (0.13 or newer; tested with 0.13.5). The setup step checks for it and stops with an upgrade message if it is missing | runs the Python scripts and the Python audits (uv audit, uvx pip-audit) |
| Node.js / npm | any current LTS (tested with Node 24) | npm audit and global package checks |
| GitHub CLI (gh), signed in | any | advisory severity and publish dates from the GitHub Advisory Database. Without it, the scripts fall back to OSV |
| .NET SDK | 9.0.300 or newer, the first with dotnet list package --vulnerable (tested with 10.0.402). Older SDKs are noted at setup and .NET projects are not audited | only if projects use .NET |
| Go | any supported release | only if projects use Go; govulncheck. Not needed for checking Go-built programs |
| Claude Code | tested with 2.1.308. Needs background agents; the PowerShell tool is used when present, otherwise Bash | running the skill |
| Claude Code signed in to claude.ai | the Artifact tool | publishing the page. Without it every run is dry and the page is the local file |
## Install
Clone the repo wherever you keep tools, then run the installer from that folder:
powershell
git clone https://github.com/ssahmed532/win-dev-patch-triage
cd win-dev-patch-triage
pwsh -ExecutionPolicy Bypass -File .\install.ps1
install.ps1 links ~/.claude/skills/win-dev-patch-triage to this folder with a directory junction, so the
repo is the only copy and edits are live. It creates no config; the first run does that. Restart Claude Code afterwards.
-ExecutionPolicy Bypass applies to that one command only. Without it, Windows PowerShell 5.1 blocks every script on
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/ssahmed532-sa-workstation-patch-triage/)
- Source
- github · https://github.com/ssahmed532/sa-workstation-patch-triage
- Browse by field
- Open source
- Listed by
- 2 independent sources
- added
- today
- Security policy
- no
SECURITY.mdat the repository root (which does not mean it is unsafe)
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.