dr-claw

Guides for using ai agents skills like dr-claw.

• Caveman: Cut Claude Token Use by 65%

  How agent-side prompt compression works, when to use it, and when not to.
• What is an AI Skills Marketplace?

  Definitions, how marketplaces work, and how to choose between them in 2026.
• Getting Started with AI Skills

Last scanned: 7/17/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@babel/core: @babel/core: Arbitrary File Read via sourceMappingURL Comment",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@chevrotain/cst-dts-gen: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@chevrotain/gast: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@tootallnate/once: @tootallnate/once vulnerable to Incorrect Control Flow Scoping",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@xmldom/xmldom: xmldom: Uncontrolled recursion in XML serialization leads to DoS",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "basic-ftp: basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "body-parser: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "cacache: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "chevrotain: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "chevrotain-allstar: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "defu: defu: Prototype pollution via `__proto__` key in defaults argument",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "dompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "electron: Electron: AppleScript injection in app.moveToApplicationsFolder on macOS",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "esbuild: esbuild allows arbitrary file read when running the development server on Windows",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "express: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "express-rate-limit: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono has CSS Declaration Injection via Style Object Values in JSX SSR",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "http-proxy-agent: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "langium: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash-es: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "make-fetch-happen: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "mermaid: Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "multer: Multer vulnerable to Denial of Service via deeply nested field names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "node-gyp: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "prismjs: PrismJS DOM Clobbering vulnerability",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "react-router: React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "react-router-dom: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "react-syntax-highlighter: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "refractor: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "release-it: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "shell-quote: shell-quote quote() does not escape newlines in object .op values",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "sqlite3: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ws: ws: Uninitialized memory disclosure",
      "severity": "high"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-07-17T06:14:20.077Z",
  "npmAuditRan": true,
  "pipAuditRan": true,
  "promptInjectionRan": true
}