Orca Supply Chain Exposure Skill

Answers the question: "From this list of suspect packages, which are we actually running, where, and at what version?"

Replaces a manual sweep of inventory + SBOM queries with a single parallel check. Optimized for the moment after an MDR / vendor / news advisory lands and the team needs an exposure answer in minutes.

Usage

/orca-supply-chain-exposure @antv/util @antv/g2 @antv/g6
/orca-supply-chain-exposure log4j-core 2.14.1
/orca-supply-chain-exposure xz-utils 5.6.0,5.6.1

Or natural language:

• "are we exposed to the @antv npm attack?"
• "check these packages: react-devtools 4.28.0, axios 0.21.0"
• "any assets with xz-utils 5.6.x?"
• "supply chain check on this IOC list"