Guides for using ai agents skills like xuanji.

• Caveman: Cut Claude Token Use by 65%

  How agent-side prompt compression works, when to use it, and when not to.
• What is an AI Skills Marketplace?

  Definitions, how marketplaces work, and how to choose between them in 2026.
• Getting Started with AI Skills

Last scanned: 7/23/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@anthropic-ai/claude-code: @anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@babel/core: @babel/core: Arbitrary File Read via sourceMappingURL Comment",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@larksuiteoapi/node-sdk: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@vitest/coverage-v8: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "@vitest/ui: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "@xenova/transformers: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@xmldom/xmldom: xmldom: Uncontrolled recursion in XML serialization leads to DoS",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Large numeric range defeats documented `max` DoS protection",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "concurrently: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "joi: joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "onnx-proto: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "onnxruntime-web: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "protobufjs: Arbitrary code execution in protobufjs",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "sharp: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "shell-quote: shell-quote quote() does not escape newlines in object .op values",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "tar: node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite-node: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vitest: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "xlsx: Prototype Pollution in sheetJS",
      "severity": "high"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-07-23T06:30:16.524Z",
  "npmAuditRan": true,
  "pipAuditRan": true,
  "promptInjectionRan": true
}