Guides for using ai agents skills like turbowebfetch.

• Caveman: Cut Claude Token Use by 65%

  How agent-side prompt compression works, when to use it, and when not to.
• What is an AI Skills Marketplace?

  Definitions, how marketplaces work, and how to choose between them in 2026.
• Getting Started with AI Skills

  First-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.

Last scanned: 7/25/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/eslint-plugin: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/parser: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/type-utils: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/typescript-estree: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@typescript-eslint/utils: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ajv: ajv has ReDoS when using `$data` option",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "body-parser: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono vulnerable to XSS through ErrorBoundary component ",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vitest: When Vitest UI server is listening, arbitrary file can be read and executed",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "ws: ws: Uninitialized memory disclosure",
      "severity": "high"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-07-25T06:19:52.865Z",
  "npmAuditRan": true,
  "pipAuditRan": true,
  "promptInjectionRan": true
}