OK, I took a look at the URLPackageScanner class [1] and it has very few dependencies to the rest of Shrinkwrap so I would vote for internalizing a trimmed down version of the class.

It's Apache 2.0 licensed so no license issues here.

[1] https://github.com/shrinkwrap/shrinkwrap/blob/master/impl-base/src/main/java/org/jboss/shrinkwrap/impl/base/URLPackageScanner.java