ai-security-tool

Guides for using ai agents skills like ai-security-tool.

• Caveman: Cut Claude Token Use by 65%

  How agent-side prompt compression works, when to use it, and when not to.
• How to Test an AI Skill: A Practical Guide to Evals

  Evaluate skills with realistic fixtures, a baseline, and repeatable checks.
• Getting Started with AI Skills

Last scanned: 9/18/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@xmldom/xmldom: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "adm-zip: adm-zip: Crafted ZIP file triggers 4GB memory allocation",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "app-builder-lib: electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "builder-util: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "builder-util-runtime: electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "dmg-builder: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "electron: Electron has ASAR Integrity Bypass via resource modification",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "electron-builder: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "electron-builder-squirrel-windows: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "electron-publish: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "extract-zip: extract-zip unvalidated symlink path traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
      "severity": "critical"
    },
    {
      "file": "README.md",
      "line": 288,
      "type": "remote-install",
      "message": "Install command (remote install script piped to a shell — review the source before running): \"curl -o- https://raw.githubusercontent.com/ZeroDayEvil/ai-security-tool/main/scr\"",
      "severity": "low"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-09-18T08:47:58.068Z",
  "npmAuditRan": true,
  "pipAuditRan": true,
  "promptInjectionRan": true
}