{"feedVersion":"1.0","generatedAt":"2026-10-25T12:25:51.528Z","description":"SkillAudit Threat Intelligence Feed — real-time security findings from AI skill scans","totalScansProcessed":3807,"recentThreats":{"count":20,"severityBreakdown":{"critical":5,"high":0,"medium":15,"low":0},"uniqueDomains":2,"items":[{"scanId":"e25a858a1f37","source":"https://www.githubstatus.com","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":912,"detectedAt":"2026-10-23T05:05:03.914Z"},{"scanId":"e25a858a1f37","source":"https://www.githubstatus.com","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":893,"detectedAt":"2026-10-23T05:05:03.914Z"},{"scanId":"e25a858a1f37","source":"https://www.githubstatus.com","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":877,"detectedAt":"2026-10-23T05:05:03.914Z"},{"scanId":"e25a858a1f37","source":"https://www.githubstatus.com","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":865,"detectedAt":"2026-10-23T05:05:03.914Z"},{"scanId":"e25a858a1f37","source":"https://www.githubstatus.com","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":835,"detectedAt":"2026-10-23T05:05:03.914Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":893,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":834,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":820,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":811,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":912,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":877,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":865,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":835,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":777,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1c0ce0596973","source":"https://www.githubstatus.com/","domain":"www.githubstatus.com","ruleId":"SHELL_EXEC","severity":"medium","category":"code_execution","name":"Shell command execution","description":"Skill executes shell commands that could be dangerous","line":391,"detectedAt":"2026-10-23T05:03:54.424Z"},{"scanId":"1b32de077747","source":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a","domain":"www.cisa.gov","ruleId":"INTENT_EXPLICIT_EXFILTRATION","severity":"critical","category":"intent_analysis","name":"Explicit exfiltration","description":"Instruction explicitly mentions exfiltration","line":1593,"detectedAt":"2026-10-21T22:00:23.330Z"},{"scanId":"1b32de077747","source":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a","domain":"www.cisa.gov","ruleId":"INTENT_EXPLICIT_EXFILTRATION","severity":"critical","category":"intent_analysis","name":"Explicit exfiltration","description":"Instruction explicitly mentions exfiltration","line":1536,"detectedAt":"2026-10-21T22:00:23.330Z"},{"scanId":"1b32de077747","source":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a","domain":"www.cisa.gov","ruleId":"INTENT_EXPLICIT_EXFILTRATION","severity":"critical","category":"intent_analysis","name":"Explicit exfiltration","description":"Instruction explicitly mentions exfiltration","line":1328,"detectedAt":"2026-10-21T22:00:23.330Z"},{"scanId":"1b32de077747","source":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a","domain":"www.cisa.gov","ruleId":"INTENT_EXPLICIT_EXFILTRATION","severity":"critical","category":"intent_analysis","name":"Explicit exfiltration","description":"Instruction explicitly mentions exfiltration","line":1322,"detectedAt":"2026-10-21T22:00:23.330Z"},{"scanId":"1b32de077747","source":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a","domain":"www.cisa.gov","ruleId":"INTENT_SECURITY_DISABLE_INTENT","severity":"critical","category":"intent_analysis","name":"Security disable intent","description":"Instruction asks to disable security measures","line":1278,"detectedAt":"2026-10-21T22:00:23.330Z"}]},"flaggedDomains":{"count":10,"items":[{"domain":"www.githubstatus.com","riskLevel":"critical","riskScore":377,"url":"https://www.githubstatus.com","flaggedAt":"2026-10-23T05:05:03.918Z"},{"domain":"www.githubstatus.com","riskLevel":"critical","riskScore":377,"url":"https://www.githubstatus.com/","flaggedAt":"2026-10-23T05:03:54.431Z"},{"domain":"www.cisa.gov","riskLevel":"critical","riskScore":173,"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a","flaggedAt":"2026-10-21T22:00:23.336Z"},{"domain":"attack.mitre.org","riskLevel":"critical","riskScore":54,"url":"https://attack.mitre.org/techniques/T1003/","flaggedAt":"2026-10-21T22:00:22.228Z"},{"domain":"github.com","riskLevel":"critical","riskScore":92,"url":"https://github.com/vercel-labs/skills","flaggedAt":"2026-10-21T09:10:49.243Z"},{"domain":"github.com","riskLevel":"critical","riskScore":149,"url":"https://github.com/heygen-com/hyperframes.git","flaggedAt":"2026-10-21T09:08:30.018Z"},{"domain":"attack.mitre.org","riskLevel":"critical","riskScore":69,"url":"https://attack.mitre.org/techniques/T1190/","flaggedAt":"2026-10-20T09:06:31.284Z"},{"domain":"raw.githubusercontent.com","riskLevel":"critical","riskScore":1237,"url":"https://raw.githubusercontent.com/eugeniughelbur/obsidian-second-brain/main/SKILL.md","flaggedAt":"2026-10-17T05:43:13.478Z"},{"domain":"raw.githubusercontent.com","riskLevel":"moderate","riskScore":10,"url":"https://raw.githubusercontent.com/eugeniughelbur/obsidian-second-brain/main/.claude-plugin/marketplace.json","flaggedAt":"2026-10-17T05:43:12.981Z"},{"domain":"raw.githubusercontent.com","riskLevel":"critical","riskScore":210,"url":"https://raw.githubusercontent.com/eugeniughelbur/obsidian-second-brain/main/integrations/obsidian-mcp-server/README.md","flaggedAt":"2026-10-17T05:43:12.937Z"}]},"trendingRules":{"count":10,"description":"Most frequently triggered detection rules across all scans","items":[{"ruleId":"CMD_INJECTION","hitCount":4216},{"ruleId":"SSRF_ADVANCED","hitCount":1141},{"ruleId":"CROSS_TOOL_ACCESS","hitCount":476},{"ruleId":"SSRF_PATTERN","hitCount":434},{"ruleId":"CRYPTO_THEFT","hitCount":424},{"ruleId":"A2A_CROSS_AGENT_INJECT","hitCount":390},{"ruleId":"A2A_DATA_LEAK","hitCount":381},{"ruleId":"NET_SUSPICIOUS","hitCount":324},{"ruleId":"SHELL_EXEC","hitCount":291},{"ruleId":"A2A_TASK_HIJACK","hitCount":285}]},"subscribe":{"polling":"GET /feed?severity=high&limit=50 — poll for updates","since":"GET /feed/since?ts=<unix_ms> — get threats after a timestamp","webhook":"POST /scan/url with callback parameter for per-scan notifications"}}