qwen-code

Guides for using ai agents skills like qwen-code.

• Caveman: Cut Claude Token Use by 65%

  How agent-side prompt compression works, when to use it, and when not to.
• What is an AI Skills Marketplace?

  Definitions, how marketplaces work, and how to choose between them in 2026.
• Getting Started with AI Skills

Last scanned: 8/4/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@babel/core: @babel/core: Arbitrary File Read via sourceMappingURL Comment",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@isaacs/brace-expansion: @isaacs/brace-expansion has Uncontrolled Resource Consumption",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@larksuiteoapi/node-sdk: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@microsoft/api-extractor: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@microsoft/api-extractor-model: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@microsoft/tsdoc-config: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@mobilewright/core: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/sdk: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/core: OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-logs-otlp-grpc: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-logs-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-logs-otlp-proto: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-metrics-otlp-grpc: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-metrics-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-metrics-otlp-proto: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-prometheus: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-trace-otlp-grpc: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-trace-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-trace-otlp-proto: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-zipkin: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/instrumentation-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-exporter-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-grpc-exporter-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-transformer: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/propagator-b3: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/propagator-jaeger: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/resources: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-logs: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-metrics: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-node: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-trace-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-trace-node: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rushstack/node-core-library: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rushstack/terminal: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rushstack/ts-command-line: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@vitest/browser: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "@vitest/coverage-v8: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "ajv: ajv has ReDoS when using `$data` option",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "dompurify: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "echarts: Apache ECharts has a cross-site scripting (XSS) vulnerability",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to host confusion via backslash authority introducer",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "linkify-it: linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "mobilewright: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "protobufjs: protobufjs: Denial of Service via infinite loop in .proto option parsing",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "sharp: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "storybook: Storybook Dev Server is Vulnerable to WebSocket Hijacking",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tar: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "undici: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite middleware may serve files starting with the same name with the public directory",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite-node: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vitest: Vulnerability found",
      "severity": "critical"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-08-04T06:27:15.466Z",
  "npmAuditRan": true,
  "pipAuditRan": true,
  "promptInjectionRan": true
}