flowix

Guides for using ai agents skills like flowix.

• Caveman: Cut Claude Token Use by 65%

  How agent-side prompt compression works, when to use it, and when not to.
• How to Test an AI Skill: A Practical Guide to Evals

  Evaluate skills with realistic fixtures, a baseline, and repeatable checks.
• Getting Started with AI Skills

  First-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.

Last scanned: 8/15/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "body-parser: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "dompurify: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "esbuild: esbuild allows arbitrary file read when running the development server on Windows",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to host confusion via literal backslash authority delimiter",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: js-yaml: YAML merge-key chains can force quadratic CPU consumption",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "mermaid: Mermaid configuration APIs allow prototype pollution",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "nanoid: nanoid: non-secure generators can loop indefinitely with negative size",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "undici: undici vulnerable to downstream response desynchronization via retry interceptor",
      "severity": "high"
    }
  ],
  "status": "WARNING",
  "scannedAt": "2026-08-15T04:29:51.283Z",
  "npmAuditRan": true,
  "pipAuditRan": true,
  "promptInjectionRan": true
}