Phalanx runs parallel-fork CVE remediation on a GitHub repository. Paste a repo URL, and the skill detects critical CVEs in the dependency tree, forks the dependency state N ways via Ghost, validates each hypothesis in isolated InsForge backends, cancels false positives mid-flight via Redis Pub/Sub, converts the Dockerfile to a Chainguard zero-CVE base, and publishes a signed evidence chain to cited.md. Use when the user asks to scan a repository for vulnerabilities, remediate a CVE autonomously, generate an SBOM with attestation, or produce a legally-defensible security remediation record. Also use for keywords like "CVE", "supply chain attack", "dependency audit", "zero-day remediation", "SBOM", "Sigstore", or "security remediation."
npx @senso-ai/shipables install ElijahUmana/phalanxWhen the user asks to scan a repo, remediate a CVE, or produce a signed SBOM, use this skill to drive the Phalanx pipeline and stream results back.
https://github.com/owner/repo).https://phalanx-sandy.vercel.app/api/scan with {"repoUrl": "<url>"} and get back a scanId.https://phalanx-sandy.vercel.app/api/status?scanId=<scanId>.scan.complete event) when the stream ends.SCAN=$(curl -s -X POST https://phalanx-sandy.vercel.app/api/scan \
-H 'Content-Type: application/json' \
-d '{"repoUrl":"'"$REPO_URL"'"}' | jq -r .scanId)
curl -N "https://phalanx-sandy.vercel.app/api/status?scanId=$SCAN"
The stream emits typed PhalanxEvent frames. Group them into phases for the user:
scan.started, deps.parsed, cve.found, tinyfish.search, tinyfish.fetch, nexla.feed.ingestredis.vector.match, redis.langcache.hit, redis.stream.dispatch, wundergraph.query, wundergraph.scope.denied, guild.actionghost.fork.started, ghost.fork.complete, insforge.provision, insforge.validateredis.pubsub.cancel, hypothesis.cancelled, insforge.cleanup — a false positive was detected and one fork was reclaimed mid-flight. Call this out explicitly; it's the parallel-speculative pattern's unique strength.chainguard.dfc.convert (before/after image), chainguard.sbom (signed with Sigstore)tinyfish.navigate (vendor portal), x402.payment (Base Sepolia tx hash)guild.approval.granted, tinyfish.pr.created, senso.published (cited.md URL), nexla.writebackscan.complete with evidenceUrl, or scan.failed with errorLead with the outcome, not the event firehose. When the scan completes:
cve.found.data.cveId).scan.complete.data.winningForkId).scan.complete.data.evidenceUrl).Do not narrate every intermediate event. The Phalanx dashboard at https://phalanx-sandy.vercel.app/dashboard is the full visual; link the user there if they want to watch live.
syft or cosign directly).src/lib/events/types.ts in the repo