InfraStack launches free threat-intel skill so Claude Code and Cursor can catch CVEs while coding
Scobleizer · x · 2026-11-05
InfraStack released a free security skill for Claude Code, Cursor, Codex, OpenCode and Copilot—no API key or MCP server needed. Coding agents query a large threat-intelligence database to check code and PRs against the latest CVEs, malicious packages and MCP vulnerabilities.
A demo against a Next.js/React app shows reachability analysis: React2Shell (CVE-2025-55182, exploited in the wild) reachable via checkout Server Actions, a Next.js image RCE (GHSA-2464-fhr4-w9xw) reachable due to permissive SVG config, and an axios prototype-pollution CVE flagged as lower priority. The skill then bumped dependency versions, tightened the image config, ran tests, and opened a fix PR.
More from coding & agent
- Claude spontaneously finds a serious OpenBLAS bug while just explaining code to a user — Aizkmusic · 2026-11-05
- Next-gen task management: agents should book human attention via MCP — lxfater · 2026-11-05
- GraphRAG in real projects: 3 practical patterns from Daan Di Scala's webinar — Al_Grigor · 2026-11-05
- Orderain ships an MCP server that lets Claude run your ecommerce store on autopilot — Slight_Guest3459 · 2026-11-05
- OpenAI 'Presence' page surfaces, pushing trusted AI agents into customer channels — juberti · 2026-11-05
- RL teaches agents to use their own notes; training survives 23M tokens of memory edits — simran_s_arora · 2026-11-05