binuka200

Package Doctor — Development skill for Claude Code

Development community

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS.

How to install Package Doctor

This entry records only its repository, not the path inside it, so there is no exact command to give. Open binuka200/package-doctor and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Package Doctor does

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS. Runs in CI and as a Claude Code hook.

Alternatives in Development

Rank — /rank - Triage Scraped Jobs into a Ranked Shortlist 36.6k ★
Gemini CLI Foundations — This repository is a comprehensive skills library for Gemini CLI - reusable, production-ready skill packages t 5.3k ★
Breach Check — HIBP k-anonymity check on a password wordlist 4.5k ★

README

package-doctor

[![CI](https://github.com/binuka200/package-doctor/actions/workflows/ci.yml/badge.svg)](https://github.com/binuka200/package-doctor/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/package-doctor.svg)](https://pypi.org/project/package-doctor/) [![Python](https://img.shields.io/pypi/pyversions/package-doctor.svg)](https://pypi.org/project/package-doctor/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/binuka200/package-doctor/blob/main/LICENSE)

**Tells you which Python dependencies to fix first: the ones being exploited, and the ones nobody is left to patch. Then stops your coding agent from adding another.**

![package-doctor scan of a ten-dependency project: pillow and litellm under FIX TODAY for CVEs on CISA's known-exploited list; bleach to replace, archived and marked Inactive; nltk to mitigate, with one advisory no release fixes; requests, pyjwt, flask and jinja2 to upgrade; python-dateutil quiet. Seven of ten fail the build.](https://raw.githubusercontent.com/binuka200/package-doctor/main/docs/images/scan.png)

A demo project with deliberately old pins, scanned on 16 September 2026. Advisory and exploitation data change daily, so the same pins will not read the same later.

In late August 2026, Anthropic's coordinated disclosure programme reported 2,300 vulnerabilities across 392 open source projects. 421 had been patched upstream. Discovery is becoming automated; remediation still needs a human. So the question worth asking about a dependency is not *"is it healthy?"* It is:

**If a vulnerability lands in this package tomorrow, am I exposed, and is anyone home to fix it?**

What it does

Two axes, not one. A package is escalated only when it sits at a trust boundary - it parses, decodes or authenticates data an attacker can influence - and there is proof nobody is left to ship a fix. mock going quiet is not a finding; an archived auth library is. The