Guides for using ai agents skills like WebCraft.

• Caveman: Cut Claude Token Use by 65%

  How agent-side prompt compression works, when to use it, and when not to.
• What is an AI Skills Marketplace?

  Definitions, how marketplaces work, and how to choose between them in 2026.
• Getting Started with AI Skills

Last scanned: 5/30/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@ai-sdk/anthropic: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@ai-sdk/provider-utils: @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@ai-sdk/react: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@ai-sdk/ui-utils: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@cloudflare/vite-plugin: Cloudflare Vite plugin exposes secrets over the built-in dev server",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "agents: Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "ai: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion Regular Expression Denial of Service vulnerability",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "craftjs: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "defu: defu: Prototype pollution via `__proto__` key in defaults argument",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ejs: ejs template injection vulnerability",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "jsondiffpatch: jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "lodash: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "miniflare: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite bypasses server.fs.deny when using ?raw??",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "workers-ai-provider: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "wrangler: Wrangler affected by OS Command Injection in `wrangler pages deploy`",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ws: ws: Uninitialized memory disclosure",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "youch: Vulnerability found",
      "severity": "low"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-05-30T16:06:57.825Z",
  "npmAuditRan": true,
  "pipAuditRan": true
}