we have plenty of tools to parse manifest.yaml like: https://forum.snapcraft.io/t/checking-ubuntu-security-notices-for-a-snap/23410 as well as the https://sources.iotdevice.io/ service (i'm sure there are more) the core, core18 and core20 snaps are built by invoking live-build outside of snapcraft and while the core snaps all ship the package list of staged debs inside them as /usr/share/snappy/dpkg.list, these debs do not show up in manifest.yaml, making it hard to use any standard tools parsing the manifest.yaml file. core snaps should be special cased in snapcraft so that the content of dpkg.list can show up as primed-stage-packages in manifest.yaml