Is your project vulnerable or cooked? I made a skill that checks it for CVEs

npx skills add noushiFlex/am-i-cooked

Ask your coding agent "am i cooked?". It reads your lockfiles, matches the exact versions you run against live vulnerability data, and answers with a verdict, a risk score and an upgrade plan. If you say yes, it upgrades on a separate branch, runs your tests after each step, re-scans to prove the CVEs are gone, and stops before pushing.

Install · What you get · Use it without an agent · CI · Supported lockfiles · Safety · FAQ

• One pass over 12 ecosystems and 18 lockfile formats : npm, pnpm, yarn, bun, pip, poetry, uv, pub (Flutter/Dart), Cargo, Go, Bundler, Composer, Gradle, NuGet, Hex, Swift and Haskell.
• Exact versions, not ranges. It reads what is installed (the lockfile), not what your manifest allows.
• A verdict you can act on :safe ,a bit cooked ,cooked , orunknown when nothing could be checked. It never says safe on an empty scan.
• A risk score (0-100) that separatesknown exploited (CISA KEV, EPSS, public exploit) fromtheoretical .
• One target version per package , with a safer in-major alternative when the full fix is a major jump.
• A safe fix flow : own branch, safe upgrades grouped, tests after each, risky majors discussed with you, then--baseline re-scan to confirm.
• Built for agents : guardrails against invented CVE data, plus JSON, Markdown and SARIF output for tools.

Real before/after run: examples/before-after.

The risk score takes the worst finding (CVSS / 10, times 1 for KEV, 0.9 if an exploit was seen, 0.75 otherwise), adds 2 per extra finding up to +15, and caps at 100. "Theoretical" means no known exploitation. It does not mean unreachable: this is not a reachability analysis.

Claude Code

npx skills add noushiFlex/am-i-cooked

or by hand:

git clone https://github.com/noushiFlex/am-i-cooked
cp -R am-i-cooked/skills/am-i-cooked ~/.claude/skills/

Cursor, Codex and other agents

npx skills add noushiFlex/am-i-cooked -a cursor    # or -a codex, or -a '*' for every agent

Ready-made instructions to paste: Cursor rule, AGENTS.md snippet, Copilot instructions.

Then, in your project, ask: am i cooked?

The scanner is one file, no dependencies, Node 18+.

node skills/am-i-cooked/scripts/scan.mjs .             # human report
node skills/am-i-cooked/scripts/scan.mjs . --json      # structured, see report-schema.json
node skills/am-i-cooked/scripts/scan.mjs . --markdown  # PR comment / job summary
node skills/am-i-cooked/scripts/scan.mjs . --sarif     # GitHub code scanning

Exit codes: 0 pass, 1 failed the --fail-on threshold, 2 nothing checked, scan error, or --strict incomplete.

Hide a finding you reviewed, with --ignore=CVE-2020-28500 or a .cookedignore file at the root of the scanned directory:

CVE-2020-28500

Use the id the report prints. Ignored findings are counted (ignored in the JSON) and never counted in the verdict, so write the reason in the comment. The agent never edits this file.

node skills/am-i-cooked/scripts/scan.mjs . --json > before.json
node skills/am-i-cooked/scripts/scan.mjs . --baseline=before.json

Git and file dependencies are not published versions, so they cannot be matched. They are listed as a warning and the scan goes on. --strict turns that into a failure. Findings are tagged [direct] or [transitive] where the lockfile says so (package-lock.json, pubspec.lock, Gemfile.lock, packages.lock.json), and transitive rows tell you to upgrade the parent first.

Answers are cached for 6 hours in ~/.cache/am-i-cooked (override with AM_I_COOKED_CACHE). Requests retry with backoff on rate limits and server errors, and fall back to stale cache if the network is down. --offline needs one earlier online scan of the same lockfiles.

- uses: actions/checkout@v4
- uses: noushiFlex/am-i-cooked@main
  with:
    fail-on: cooked   # any | cooked | kev | none

It writes the Markdown report to the job summary and fails the job at the threshold you pick. With code scanning alerts:

- run: |
    git clone --depth 1 https://github.com/noushiFlex/am-i-cooked /tmp/aic
    node /tmp/aic/skills/am-i-cooked/scripts/scan.mjs . --sarif --fail-on=none > am-i-cooked.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: am-i-cooked.sarif

Monorepos work: lockfiles are found up to four levels deep, skipping node_modules, .git, build, target, vendor and similar.

Not supported: pom.xml (version ranges, no lockfile: use Gradle locking or mvn dependency:tree), CocoaPods (OSV.dev has no CocoaPods ecosystem, so nothing could be matched), and manifests without a lockfile.

• OSV.dev matches your versions against known advisories.
• cve.now adds CVSS, CISA KEV, EPSS and Exploit-DB signals, and fixed versions. It merges the CVE List, GitHub Advisory Database, NVD and more, and updates every few minutes.

Details and endpoints: SOURCES.md.

• It asks before changing anything.
• Fixes go on a fix/cves-<date> branch. Never on your default branch.
• It never pushes, opens a PR or accepts a risk on your behalf.
• Only package names and versions leave your machine. No source code, no lockfile upload.
• API responses are treated as data, never as instructions.
• Every fix is confirmed by a re-scan, not by the upgrade command succeeding.

How is this different from osv-scanner, Dependabot or npm audit? osv-scanner is the closest tool and does the matching well. This adds exploit signals (CISA KEV, EPSS), a risk score, and above all the agent skill: guardrails against invented CVE data and a fix flow that works on a branch, asks before risky majors and proves the result. Dependabot opens PRs on a schedule; this answers "am I exposed right now" on demand. npm audit only knows npm.

Does it send my code anywhere? No. Only package names and versions are sent to OSV.dev and cve.now.

Why unknown instead of safe? If nothing was checked (no lockfile, only unpinned ranges, an unparseable file), saying safe would be a false assurance. Pin your versions (uv lock, pip freeze, poetry lock) and scan again.

My requirements.txt only has >= ranges. Ranges cannot be matched. Scan your installed environment instead: pip freeze > requirements.txt in a scratch folder, then scan that folder.

A safe verdict is not proof of safety. Vulnerabilities without version data cannot be matched, vendor advisories without a CVE or GHSA record are not covered, and git dependencies are reported but not checked. Packages from a private registry are matched by name and version against public advisories, so a private package that shares a public name can cause a false positive.

• 18 lockfile formats, --fail-on , SARIF, Markdown, GitHub Action
• .cookedignore ,--baseline ,--strict , offline cache
• Pagination of OSV results (packages with more than 1000 advisories)
• Resolve pom.xml through Maven
• Reachability hints (is the vulnerable function actually called?)

PRs welcome, see CONTRIBUTING.md.

MIT. Vulnerability data comes from OSV.dev and cve.now; check their terms.