Guides for using ai agents skills like gemini-flow.

• Caveman: Cut Claude Token Use by 65%

  How agent-side prompt compression works, when to use it, and when not to.
• What is an AI Skills Marketplace?

  Definitions, how marketplaces work, and how to choose between them in 2026.
• Getting Started with AI Skills

Last scanned: 5/24/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@babel/plugin-transform-modules-systemjs: @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@isaacs/brace-expansion: @isaacs/brace-expansion has Uncontrolled Resource Consumption",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@mapbox/node-pre-gyp: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/sdk: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/server-github: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/server-memory: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/server-puppeteer: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/server-sequential-thinking: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rollup/plugin-terser: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@tootallnate/once: @tootallnate/once vulnerable to Incorrect Control Flow Scoping",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/eslint-plugin: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/parser: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/type-utils: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/typescript-estree: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/utils: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ajv: ajv has ReDoS when using `$data` option",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "basic-ftp: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "bull: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "canvas: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "engine.io: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "engine.io-client: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "express: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "googleapis: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "googleapis-common: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "jws: auth0/node-jws Improperly Verifies HMAC Signature",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "libnpmdiff: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash-es: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "node-forge: node-forge has ASN.1 Unbounded Recursion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "npm: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "pacote: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "protobufjs: Arbitrary code execution in protobufjs",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "serialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "socket.io-adapter: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "socket.io-parser: socket.io allows an unbounded number of binary attachments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "socks: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tar-fs: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "valibot: Valibot has a ReDoS vulnerability in `EMOJI_REGEX`",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ws: ws: Uninitialized memory disclosure",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
      "severity": "medium"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-05-24T07:23:34.041Z",
  "semgrepRan": false,
  "npmAuditRan": true,
  "pipAuditRan": true
}