`vulkro-sf org packages`

Lists the packages installed in the live org and flags beta and unmanaged ones.

vulkro-sf org packages --target-org <alias>
vulkro-sf org packages -o <alias> --verify --format json

Finding	Severity	Meaning
`SF-PKG-001`	Medium	A beta package version is installed.
`SF-PKG-002`	Low	An unmanaged package is installed: its code is editable in the org and was not security reviewed.

Salesforce's own platform packages are skipped.

`--verify`

Checks each managed package against a package catalog bundled in the binary:

Finding	Severity	Meaning
`SF-PKG-VERIFY-001`	High	The package has a published High or Critical advisory.
`SF-PKG-VERIFY-002`	Medium	The package's latest security review is more than 18 months old.
`SF-PKG-VERIFY-003`	Low	The package is not in the catalog. Review the publisher by hand.

The catalog ships with each release, so it can lag behind the live marketplace.

--format takes table (default) or json.