Low Severity
Published: Nov 8, 2026
Claude Code skill: read-only vulnerability scanner and patch triage for Windows 11 dev machines. Checks apps, runtimes and dependencies (npm, PyPI, NuGet, Go, Cargo, Composer), flags malicious packages and CISA KEV CVEs, and ranks what to patch today.
# win-dev-patch-triage
A Claude Code skill that runs a read-only security patch triage of a Windows 11 developer workstation and publishes a
ranked remediation page: what to update today, this week, and in the backlog, with a comparison against the previous run.
It checks:
- installed apps and browsers (winget, plus file versions for apps winget does not track)
- AI agent apps and CLIs: the Claude and ChatGPT desktop apps, and every copy of Claude Code, Codex and OpenCode (native, winget, npm or bun), with the CLIs checked against OSV
- language runtimes and toolchains: Node.js, CPython via uv, .NET, Go, PowerShell, Git and others on PATH, plus PHP, Java or Ruby found off PATH
- every copy of Node.js, PHP and Bun (on PATH, off PATH, and the Node versions nvm-windows, fnm and Volta keep), checked against the vendors' release feeds (security releases and end of support) and, for PHP and Bun, the advisories on their GitHub repositories; Composer and pnpm are checked against theirs too
- every copy of pip: in each Python install (system-wide, per-user and uv-managed) and in each user site that `pip install --user` writes to, checked against OSV, with whether it is the `pip` on PATH
- global npm, bun and uv tools, and the npm that ships with each Node.js copy, including the libraries bundled inside them (via OSV)
- Go-built programs on PATH (gh, lazygit, fzf, ...): the Go version and modules compiled into each, read from the file and checked against OSV
- every dependency lockfile under one or more projects folders: uv, pip/requirements, npm, pnpm, yarn, bun, Composer, NuGet, Go and Cargo
- malicious package versions (OSV's `MAL-` records and GitHub's malware advisories), and CVEs in CISA's Known Exploited Vulnerabilities catalog
- old copies left installed next to new ones, and commands whose copy in a user folder shadows the system copy
- WSL distros (key package versions and how stale the apt lists are), listening ports, and the OS patch level
- vendor advisories re