Low Severity
Published: Nov 14, 2026
Security news for your stack: an agent skill and the CLI it relies on. Ask your AI agent "anything today?" and get a straight answer.
# stackalarm
**Type `/stackalarm` in your AI agent and get a straight answer about your project's security today.**
stackalarm is an agent skill and the CLI it relies on. Open a project in Claude Code, Codex, Cursor or another agent, run the skill, and the agent tells you what in this week's security news affects *this* repository, how urgent it is, and what to change.
**[stackalarm.dev](https://stackalarm.dev)**: what it does and an example answer. **[Documentation](https://stackalarm.dev/docs/)**: the skill, every CLI option, the scheduled watch, the sources.
## How it works
- **The skill is the analyst.** It reads the project (manifests, lockfiles, Dockerfiles, CI, git remotes), runs the CLI, completes it with a web search and your ecosystem's audits (`composer audit`, `npm audit`, `pip-audit`, `govulncheck`…), judges what applies, and offers to fix what lives in the repository, one change at a time, after asking. It never pushes, deploys or touches a server.
- **The CLI is its eyes.** It reads more than 370 sources first-hand: project and vendor announcements, the GitHub Advisory Database, OSV.dev, the NVD and EUVD CVE databases, CERTs, CISA KEV, catalogs of public exploits and the security press. Given the versions in use, it tells which vulnerable ranges hold them. It does no project analysis.
## Install
```sh
npx skills add yoanbernabeu/stackalarm
```
The first time you run `/stackalarm`, the skill sees the CLI is missing and offers to install it; it runs nothing before you agree. To install the CLI yourself: `brew install yoanbernabeu/tap/stackalarm`, or `curl -sSL https://raw.githubusercontent.com/yoanbernabeu/stackalarm/main/install.sh | sh`. On Windows, download the zip from the [releases](https://github.com/yoanbernabeu/stackalarm/releases). With Go: `go install github.com/yoanbernabeu/stackalarm/cmd/stackalarm@latest`.
Optional: `GITHUB_TOKEN` (or `GH_TOKEN`) raises the GitHub API rate limit, and `NVD_API_KEY` ([free](https://nvd.nist.gov/devel