yd-cve-check SKILL.md skillA
This file is byte-identical to the first copy the registry indexed. Same content hash, so the same checks give both the same grade.
yd-cve-check from leeyudok/agents-scaffold is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add leeyudok/agents-scaffold/yd-cve-check@git:20261024.27d9360Pins git:20261024.27d9360 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- leeyudok/agents-scaffold
- Path
plugins/yd-skills/skills/yd-cve-check/SKILL.md- Versions recorded
- 1
- Latest version
- git:20261024.27d9360, committed Oct 24, 2026
- Size
- 6,486 bytes
- Repository stars
- 36
- License
- MIT
pnpm 프로젝트 의존성을 알려진 CVE·GHSA·악성 패키지(MAL) 데이터와 대조해 취약 버전을 찾고, package.json 지정자 상향과 범위를 묶은 overrides 로 보완한 뒤 재스캔으로 확인한다. "pnpm 취약점 점검", "CVE 체크", "보안 패치 올려줘", "audit 고쳐줘", "취약점 점검 및 보완" 요청이나 폐쇄망에서 OSV 덤프로 오프라인 점검할 때 사용한다. 소스 코드 보안 점검은 security-precheck, 빌드·번들 설정은 yd-frontend-build 가 맡는다.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# yd-cve-check 온디맨드로 부른다. 사용자가 "pnpm 취약점 점검 및 보완"이라고 하면 아래 절차를 끝까지 수행한다 — 점검만 하고 멈추지 않는다. 단, breaking 업그레이드와 패키지 제거는 사용자 확인을 받는다. ## CVE 목록은 스킬에 넣지 않는다 알려진 취약점은 **실행 시점의 DB를 조회해** 얻는다. 스킬에 목록을 박아 두면 다음 날 낡는다 (2026-10-24 OSV npm 덤프는 그날 04:48 UTC 에 갱신됐다). 원천은 둘이다. | 모드 | 원천 | 언제 | |---|---|---| | 온라인(기본) | `pnpm audit --json` — npm 레지스트리 advisory(GHSA) | 레지스트리에 닿을 때 | | 오프라인 | OSV npm 덤프 `https://osv-vulnerabilities.storage.googleapis.com/npm/all.zip` (약 219MB) | 폐쇄망·사내 미러만 있을 때. 덤프를 반입해 `--osv-db` 로 준다 | OSV 덤프는 GHSA 와 함께 **MAL-(악성 패키지) 항목**도 담는다. `pnpm audit` 는 악성 패키지를 잡지 못할 수 있으니, 폐쇄망이 아니어도 공급망 사고가 의심되면 OSV 덤프로 한 번 더 돌린다. 같은 락파일에서 두 모드의 CVE 목록은 일치했다(axios 0.21.0·lodash 4.17.15 실측). OSV 덤프 스캔은 약 9초 걸린다. ## 절차 1. **스캔** — 락파일이 있는 디렉터리에서 이 스킬 폴더의 `scripts/cve_scan.py` 를 실행한다. ```bash python3 <skill>/scripts/cve_scan.py # 온라인: pnpm audit python3 <skill>/scripts/cve_scan.py --osv-db all.zip # 오프라인: OSV 덤프 python3 <skill>/scripts/cve_scan.py --json # 기계 판독 ``` 종료 코드: 0 = 발견 없음, 1 = 발견 있음, 2 = 입력 오류. 심각도 미상은 기준과 무관하게 실패로 센다. 지원 락파일: `pnpm-lock.yaml` v6·v9 (직접/전이 구분은 `importers` 로 한다). …
Read the whole file at its exact version.
How to install
mdr add leeyudok/agents-scaffold/yd-cve-check@sha256:b7d71e48d79301e5The line at the top of this page pins the label git:20261024.27d9360, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_xwj7gncgozftcjls)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Oct 24, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6486 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
leeyudok/agents-scaffold · 36 stars · license MIT · pushed 2026-10-25 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_xwj7gncgozftcjls GET https://markdownregistry.com/api/v1/resolve?ref=leeyudok/agents-scaffold/yd-cve-check GET https://markdownregistry.com/api/v1/blob/b7d71e48d79301e573afc12151657ebcc9a424e96aec3a432caa7df2d0fa0190
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from leeyudok/agents-scaffold
Every file in leeyudok/agents-scaffold