@akshay7273/skill-advisories 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (24) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +45 -0
  3. package/dist/cli.d.ts +2 -0
  4. package/dist/cli.js +123 -0
  5. package/dist/compile-cli.d.ts +1 -0
  6. package/dist/compile-cli.js +18 -0
  7. package/dist/compile.d.ts +21 -0
  8. package/dist/compile.js +34 -0
  9. package/dist/load.d.ts +10 -0
  10. package/dist/load.js +22 -0
  11. package/dist/lookup.d.ts +15 -0
  12. package/dist/lookup.js +33 -0
  13. package/dist/scan.d.ts +11 -0
  14. package/dist/scan.js +34 -0
  15. package/dist/types.d.ts +30 -0
  16. package/dist/types.js +1 -0
  17. package/dist/validate-cli.d.ts +1 -0
  18. package/dist/validate-cli.js +16 -0
  19. package/dist/validate.d.ts +10 -0
  20. package/dist/validate.js +40 -0
  21. package/feed/feed.json +628 -0
  22. package/feed/index.json +110 -0
  23. package/package.json +51 -0
  24. package/schema/advisory.schema.json +61 -0
package/feed/index.json ADDED
@@ -0,0 +1,110 @@
1
+ {
2
+ "clawhub:auto-updater-lth9t": [
3
+ "SKA-2026-0001"
4
+ ],
5
+ "clawhub:auto-updater-m0fsa": [
6
+ "SKA-2026-0001"
7
+ ],
8
+ "clawhub:auto-updater-mclql": [
9
+ "SKA-2026-0001"
10
+ ],
11
+ "clawhub:auto-updater-mkukz": [
12
+ "SKA-2026-0001"
13
+ ],
14
+ "clawhub:auto-updater-mn5ri": [
15
+ "SKA-2026-0001"
16
+ ],
17
+ "clawhub:auto-updater-nlt3m": [
18
+ "SKA-2026-0001"
19
+ ],
20
+ "clawhub:auto-updater-ocn18": [
21
+ "SKA-2026-0001"
22
+ ],
23
+ "clawhub:auto-updater-p5rmt": [
24
+ "SKA-2026-0001"
25
+ ],
26
+ "clawhub:auto-updater-qdyme": [
27
+ "SKA-2026-0001"
28
+ ],
29
+ "clawhub:auto-updater-se38e": [
30
+ "SKA-2026-0001"
31
+ ],
32
+ "clawhub:auto-updater-sxdg2": [
33
+ "SKA-2026-0001"
34
+ ],
35
+ "clawhub:auto-updater-xcgnm": [
36
+ "SKA-2026-0001"
37
+ ],
38
+ "clawhub:auto-updater-xsunp": [
39
+ "SKA-2026-0001"
40
+ ],
41
+ "clawhub:better-polymarket": [
42
+ "SKA-2026-0002"
43
+ ],
44
+ "clawhub:polymarket-all-in-one": [
45
+ "SKA-2026-0002"
46
+ ],
47
+ "clawhub:clawhud": [
48
+ "SKA-2026-0003"
49
+ ],
50
+ "clawhub:clawhub1": [
51
+ "SKA-2026-0003"
52
+ ],
53
+ "clawhub:base-agent": [
54
+ "SKA-2026-0004"
55
+ ],
56
+ "clawhub:bybit-agent": [
57
+ "SKA-2026-0004"
58
+ ],
59
+ "clawhub:polymarket-trading-bot": [
60
+ "SKA-2026-0004"
61
+ ],
62
+ "clawhub:moltbookagent": [
63
+ "SKA-2026-0005"
64
+ ],
65
+ "clawhub:publish-dist": [
66
+ "SKA-2026-0005"
67
+ ],
68
+ "clawhub:moltbook-lm8": [
69
+ "SKA-2026-0006"
70
+ ],
71
+ "clawhub:tradingview-ai-indicator-assistant": [
72
+ "SKA-2026-0007"
73
+ ],
74
+ "clawhub:ai-tradingview-assistant-for-macos": [
75
+ "SKA-2026-0007"
76
+ ],
77
+ "clawhub:omnicogg": [
78
+ "SKA-2026-0008"
79
+ ],
80
+ "clawhub:money-radar": [
81
+ "SKA-2026-0009"
82
+ ],
83
+ "clawhub:polymarketbtc": [
84
+ "SKA-2026-0010"
85
+ ],
86
+ "clawhub:polymarketbtcassistant": [
87
+ "SKA-2026-0010"
88
+ ],
89
+ "clawhub:google-k53": [
90
+ "SKA-2026-0011"
91
+ ],
92
+ "clawhub:rankaj": [
93
+ "SKA-2026-0012"
94
+ ],
95
+ "clawhub:santi-text-game": [
96
+ "SKA-2026-0013"
97
+ ],
98
+ "clawhub:letssendit": [
99
+ "SKA-2026-0013"
100
+ ],
101
+ "clawhub:pdfcheck": [
102
+ "SKA-2026-0013"
103
+ ],
104
+ "clawhub:update": [
105
+ "SKA-2026-0013"
106
+ ],
107
+ "clawhub:wistec-core": [
108
+ "SKA-2026-0013"
109
+ ]
110
+ }
package/package.json ADDED
@@ -0,0 +1,51 @@
1
+ {
2
+ "name": "@akshay7273/skill-advisories",
3
+ "version": "0.1.0",
4
+ "description": "Open advisory database for AI agent skills, plugins, and MCP servers — machine-readable threat data for the agent ecosystem.",
5
+ "type": "module",
6
+ "license": "MIT",
7
+ "engines": {
8
+ "node": ">=20"
9
+ },
10
+ "bin": {
11
+ "skill-advisories": "dist/cli.js"
12
+ },
13
+ "main": "dist/lookup.js",
14
+ "files": [
15
+ "dist",
16
+ "schema",
17
+ "feed"
18
+ ],
19
+ "scripts": {
20
+ "validate": "tsx src/validate-cli.ts",
21
+ "compile": "tsx src/compile-cli.ts",
22
+ "build": "tsc",
23
+ "test": "vitest run",
24
+ "prepublishOnly": "npm run build && npm test"
25
+ },
26
+ "repository": {
27
+ "type": "git",
28
+ "url": "git+https://github.com/Akshay7273/skill-advisories.git"
29
+ },
30
+ "keywords": [
31
+ "security",
32
+ "advisories",
33
+ "ai-agents",
34
+ "claude",
35
+ "agent-skills",
36
+ "mcp",
37
+ "supply-chain",
38
+ "threat-intelligence"
39
+ ],
40
+ "dependencies": {
41
+ "ajv": "^8.17.1",
42
+ "ajv-formats": "^3.0.1",
43
+ "picocolors": "^1.1.1"
44
+ },
45
+ "devDependencies": {
46
+ "@types/node": "^22.10.0",
47
+ "tsx": "^4.19.0",
48
+ "typescript": "^5.7.0",
49
+ "vitest": "^3.0.0"
50
+ }
51
+ }
package/schema/advisory.schema.json ADDED
@@ -0,0 +1,61 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://raw.githubusercontent.com/Akshay7273/skill-advisories/main/schema/advisory.schema.json",
4
+ "title": "Skill Advisory",
5
+ "description": "A single security advisory for an AI agent skill, plugin, or MCP server.",
6
+ "type": "object",
7
+ "additionalProperties": false,
8
+ "required": ["schema_version", "id", "type", "summary", "severity", "artifacts", "references", "published", "modified"],
9
+ "properties": {
10
+ "schema_version": { "const": "1" },
11
+ "id": {
12
+ "type": "string",
13
+ "pattern": "^SKA-[0-9]{4}-[0-9]{4}$",
14
+ "description": "SKA-<year>-<sequence>. SKA-<year>-0000 is reserved for tooling tests."
15
+ },
16
+ "type": { "enum": ["malicious", "vulnerable", "typosquat", "compromised", "test"] },
17
+ "summary": { "type": "string", "minLength": 10, "maxLength": 200 },
18
+ "details": { "type": "string" },
19
+ "severity": { "enum": ["critical", "high", "medium", "low"] },
20
+ "behaviors": {
21
+ "type": "array",
22
+ "uniqueItems": true,
23
+ "items": {
24
+ "enum": ["credential-theft", "data-exfiltration", "backdoor", "malware-dropper", "prompt-injection", "crypto-theft", "spam", "other"]
25
+ }
26
+ },
27
+ "artifacts": {
28
+ "type": "array",
29
+ "minItems": 1,
30
+ "items": {
31
+ "type": "object",
32
+ "additionalProperties": false,
33
+ "required": ["ecosystem", "name"],
34
+ "properties": {
35
+ "ecosystem": { "enum": ["claude-skill", "claude-plugin", "clawhub", "mcp-server", "npm", "pypi", "vscode-extension", "github-action"] },
36
+ "name": { "type": "string", "minLength": 1 },
37
+ "publisher": { "type": "string" },
38
+ "versions": { "type": "array", "items": { "type": "string" } },
39
+ "sha256": { "type": "array", "items": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }
40
+ }
41
+ }
42
+ },
43
+ "references": {
44
+ "type": "array",
45
+ "minItems": 1,
46
+ "items": {
47
+ "type": "object",
48
+ "additionalProperties": false,
49
+ "required": ["type", "url"],
50
+ "properties": {
51
+ "type": { "enum": ["REPORT", "ADVISORY", "ARTICLE", "WEB"] },
52
+ "url": { "type": "string", "format": "uri" }
53
+ }
54
+ }
55
+ },
56
+ "credits": { "type": "array", "items": { "type": "string" } },
57
+ "published": { "type": "string", "format": "date-time" },
58
+ "modified": { "type": "string", "format": "date-time" },
59
+ "withdrawn": { "type": "string", "format": "date-time" }
60
+ }
61
+ }