orca-supply-chain-exposure

# Orca Supply Chain Exposure Skill Answers the question: **"From this list of suspect packages, which are we actually running, where, and at what version?"** Replaces a manual sweep of inventory + SBOM queries with a single parallel check. Optimized for the moment after an MDR / vendor / news advisory lands and the team needs an exposure answer in minutes. ## Usage ``` /orca-supply-chain-exposure @antv/util @antv/g2 @antv/g6 /orca-supply-chain-exposure log4j-core 2.14.1 /orca-supply-chain-exposure xz-utils 5.6.0,5.6.1 ``` Or natural language: - "are we exposed to the @antv npm attack?" - "check these packages: react-devtools 4.28.0, axios 0.21.0" - "any assets with xz-utils 5.6.x?" - "supply chain check on this IOC list" The user may paste a bullet list, a comma-separated list, or a table. Parse it. ## Processing Logic ### Step 1: Parse the package list Build a normalized list of `(package_name, suspected_versions[])`. If the user only gave package names with no versions, treat **any version found in the environment as a positive hit** and rely on Orca's CVE data to confirm vulnerability. ### Step 2: Run parallel exposure queries For each package, run two queries in parallel: **Query A: Direct inventory lookup** ``` discovery_search: search_phrase: "assets with package <name>" limit: 50 ``` **Query B: CVE-driven lookup** (catches assets where Orca already flags the package as vulnerable) ``` discovery_search: search_phrase: "assets with vulnerable <name> pa...