skill-advisories

Open advisory database for AI agent skills, plugins, and MCP servers — OSV-style, machine-readable threat data for the agent ecosystem.

Browse advisories: https://akshay7273.github.io/skill-advisories/

Feed health: https://akshay7273.github.io/skill-advisories/health.html

Every advisory documents a malicious, vulnerable, or typosquatted agent skill, backed by at least one published public reference (vendor report, researcher writeup, or registry takedown).

Roadmap

The project is moving toward precise version-aware detection, verifiable threat feeds, OSV interoperability, and agent-native pre-install checks through MCP. See the public roadmap for milestones and acceptance criteria.

The feed (public API)

Consume the database directly — no install needed:

• Full feed: https://raw.githubusercontent.com/Akshay7273/skill-advisories/main/feed/feed.json
• Feed SHA-256 digest: https://raw.githubusercontent.com/Akshay7273/skill-advisories/main/feed/feed.json.sha256
• Fast lookup index (ecosystem:name → advisory ids): https://raw.githubusercontent.com/Akshay7273/skill-advisories/main/feed/index.json
• Compact feed: https://raw.githubusercontent.com/Akshay7273/skill-advisories/main/feed/compact.json
• Cursor-verified incremental update: https://raw.githubusercontent.com/Akshay7273/skill-advisories/main/feed/delta.json
• Advisory schema: schema/advisory.schema.json
• OSV-compatible index: feed/osv/index.json
• Multi-file checksum manifest: feed/checksums.txt
• Append-only publication history: feed/history.json

See the OSV export and verification guide for field mapping and integrity checks. Incremental consumers should follow the compact feed and delta protocol. References may carry archival evidence provenance, and every cited page is probed weekly for link rot. A downloaded copy can be checked against its own evidence with skill-advisories verify.

Try it in 30 seconds

npx @akshay7273/skill-advisories check better-polymarket

❌ 1 advisory match(es) across 1 skill(s) checked:
  better-polymarket [clawhub] → SKA-2026-0002 [critical] better-polymarket and polymarket-all-in-one hide a reverse-shell backdoor inside operational market-search code rather than install hooks.
      https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting
      https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/

That is a real advisory with real sources, and the command exits 1 so CI stops. A name with nothing against it prints a single line and exits 0. Nothing is uploaded: the feed is downloaded and matched locally.

To check what is already installed rather than a name you type, run npx @akshay7273/skill-advisories scan.

Considering using this on a real project? docs/pilot.md describes what a pilot involves and what is asked afterwards.

CLI

# Check specific skill names
npx @akshay7273/skill-advisories check omnicogg my-other-skill

# Avoid cross-ecosystem name collisions
npx @akshay7273/skill-advisories check --ecosystem mcp-server my-server

# Evaluate a specific installed version when an advisory lists affected versions
npx @akshay7273/skill-advisories check --ecosystem npm --version 1.2.3 my-package

# Check file hashes directly (catches renamed malware)
npx @akshay7273/skill-advisories check --sha256 <64-hex-digest>

# Turn typosquat proximity warnings into failures
npx @akshay7273/skill-advisories check omnicog --strict

# Scan installed skill directories (~/.claude/skills, ~/.openclaw/skills, ...)
npx @akshay7273/skill-advisories scan

# Scan with SARIF output for GitHub Code Scanning
npx @akshay7273/skill-advisories scan ./skills --format sarif

# Offline mode using cached feed (1h TTL default)
npx @akshay7273/skill-advisories scan --offline

# Set minimum failure threshold (low, medium, high, critical)
npx @akshay7273/skill-advisories scan ./skills --fail-on high

# Refuse to act on a feed older than 12 hours
npx @akshay7273/skill-advisories scan --max-feed-age 12 --strict

# Check a downloaded feed directory against its own evidence
npx @akshay7273/skill-advisories verify ./feed

# Record the artifacts installed here as the approved set
npx @akshay7273/skill-advisories lock ./skills

# Fail CI when what is installed is not what was approved
npx @akshay7273/skill-advisories lock --check ./skills --strict

# Report the newest feed copy the published history proves good
npx @akshay7273/skill-advisories rollback ./mirror-a ./mirror-b

Common options: --format <human|json|sarif>, --fail-on <severity>, --ecosystem <id>, --version <value>, --sha256, --strict, --offline, --refresh, --max-feed-age <hours>, and --feed <url-or-path>.

Filesystem scans also support bounded execution with --concurrency, --hash-concurrency, --max-file-bytes, --max-files, --max-total-bytes, and repeatable --exclude-dir options. An incomplete scan fails closed with exit code 2; --allow-incomplete explicitly permits a partial result. See the JSON result contract for scan telemetry.

Exit codes: 0 no advisories matched · 1 findings met policy · 2 usage, feed, incomplete-scan, or stale-feed-under---strict error. The verify subcommand reports on a directory instead of on artifacts and uses its own codes, described in feed freshness and verification.

lock answers the question a feed cannot: not is this known bad, but is this the artifact that was reviewed. It records approved artifact digests in a committed lockfile and compares installed artifacts against them without consulting the feed at all. See approved artifact identities.

rollback answers the question verify cannot. A feed directory assembled by an attacker matches its own evidence perfectly, so during an incident the useful question is which of the copies you hold the published history proves good. It examines every candidate against a history supplied separately, reports the newest one the evidence justifies, and writes nothing. See verified recovery points.

Automation consumers can rely on the versioned JSON result contract.

MCP and Claude Code

Run the read-only MCP server so agents can check an artifact before installing it:

claude mcp add --transport stdio --scope user skill-advisories -- \
  npx -y -p @akshay7273/skill-advisories skill-advisories-mcp

The server provides check_artifact, get_advisory, and search_advisories. A repository can add --policy examples/policy.json to enforce severity thresholds, denied ecosystems, immutable hashes, and warning handling. See the MCP, policy, and Claude Code integration guide. OpenClaw, VS Code, and GitHub Action examples are covered by the integration contract.

GitHub Action

Fail your CI when a skill you ship or install matches a published advisory:

- uses: Akshay7273/skill-advisories@v1
  with:
    names: my-skill-name

Or scan a directory of skills:

- uses: Akshay7273/skill-advisories@v1
  with:
    scan-dir: ./skills

Upload SARIF results to GitHub Code Scanning:

- uses: Akshay7273/skill-advisories@v1
  with:
    scan-dir: .claude/skills
    sarif-file: skill-advisories.sarif
    fail-on: high
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: skill-advisories.sarif

Inputs: names (space-separated skill names), scan-dir (directory to scan), ecosystem (restrict name checks), version (installed version for name checks), feed (alternate feed URL or path), format (output format), sarif-file (SARIF output path), fail-on (minimum severity threshold).

@v1 is a moving pointer to the newest stable release, and it names the input contract above rather than the package version -- the inputs have been stable since v1 while the package is still 0.x. Pin a specific release such as @v0.8.0 if you would rather adopt changes deliberately, or a commit SHA if you want upgrades to be something you approve rather than receive; prereleases never move the pointer.

Data integrity

1. Every advisory cites at least one published public reference.
2. No hearsay: submissions without a published report or reproducible evidence are not listed.
3. Advisories can be withdrawn; disputes are handled via GitHub issues.

Accuracy & performance

Performance results are generated from a deterministic synthetic corpus and record the exact commit and environment. On the checked-in Windows/Node 24 baseline, 100,000 name lookups completed in 125 ms, a 100,000-name synthetic false-positive sweep produced zero warnings in 479 ms, and 10,000 one-file artifacts were scanned in 10.36 seconds with 214 MB peak RSS. This is a reproducible baseline, not a guarantee for other hardware or real-world artifact layouts.

See the benchmark method and results. Accuracy claims require a redistributable corpus or a documented generator; downloads and unpublished third-party collections are not used as evidence.

License

Code: MIT. Advisory data: CC-BY-4.0 — free to use with attribution.