Security Watch: let your AI agent check your projects for security patches
A read-only skill your agent runs for you. It reads your repo, compares PHP, Node, Next.js and React versions and two known malicious packages against a dated table from official advisories, and tells you in plain language what to update and where the source is. It changes nothing without your OK.
Last verified 2026-10-23. Raw Markdown: /guides/security-watch.md · Skill file: /agent-skills/security-watch/SKILL.md
Install
npx skills add https://agentpromptsatoz.com --skill security-watch
Then ask your agent: "Run the security-watch skill on this repo." Read the skill file first: it is plain Markdown.
Patched versions (last verified 2026-10-23)
| Component | Fixed or safe | Affected or bad | Identifier | Source |
|---|---|---|---|---|
| PHP | 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older: no fix exists, so the project must migrate. | Any PHP older than the fixed release in the same minor line (8.5, 8.4, 8.3, 8.2), and all of 8.1 and older. | CVE-2026-109618, CVE-2026-109619 (a third, CVE-2026-115560, was still awaiting an advisory on the verified date) | CISA alert, 2026-10-21 |
| Next.js | 16.4.1 (16.x) or 15.5.28 (15.x). Also sharp 0.35.5 or later. | next >=10.0.0 and <=15.5.27, and 16.0.0 to 16.4.0. | Next.js security update, 2026-10-14 | Next.js blog, 2026-10-14 |
| React Server Components packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) | 19.0.9, 19.1.10, 19.2.9, 19.3.1 (match your 19.0 / 19.1 / 19.2 / 19.3 line). | Those packages on an older version in the same line. | GHSA-xqc2-xf4c-x3h3 | GitHub advisory |
| Node.js | 22.23.4 (22.x), 24.22.1 (24.x), 26.12.1 (26.x). Node 20 and older are end-of-life. | Node older than the fixed release in the 22, 24 or 26 line; any Node 20 or older. | October 2026 security releases | Node.js blog |
| tensorlake (npm) | 0.5.143 is safe. | 0.5.144 is MALICIOUS (credential-stealing install script). | GHSA-8g63-53c9-65j2 | tensorlake GitHub advisory |
| litellm (Python) | 1.106.2 is the last clean release. | 1.107.0 is MALICIOUS (PyPI package and several Docker image tags). | LiteLLM incident of 2026-10-21 | LiteLLM security incident post |
A third PHP issue, CVE-2026-115560, was still awaiting an advisory on the verified date: CERT-EU. If this table is more than 7 days old when you read it, check the sources first: it is a snapshot, not a live feed.
What the agent does
- Reads the freshness date and warns you if the table is over 7 days old.
- Detects your stack from package.json, lockfiles, composer.json, Dockerfile and runtime versions.
- Compares exact versions to the table and marks each AFFECTED, OK, NOT COVERED or COULD NOT VERIFY.
- Reports "update these, here is the source", plus what it could not verify.
- Waits for you. It never upgrades or changes anything on its own.
If a malicious package turns up
The agent stops and tells you. It does not rotate or revoke tokens itself. For tensorlake 0.5.144 the vendor says to remove the gh-token-monitor service before revoking any GitHub token, because it can delete your home directory when the token is revoked. For litellm 1.107.0 the vendor says not to start with pip install in the affected environment. Follow the vendors' own steps: tensorlake advisory · LiteLLM incident post.
Install hygiene it recommends
npm cifor clean and CI installs, with a committed lockfile.--ignore-scriptswhen installing untrusted packages (some packages need their scripts, so check first).- Exact version pins in Python, and no floating Docker tags like
latest.
Honest limits
- Read-only, and a snapshot of six items checked against official pages on 2026-10-23.
- Not run against real projects in a live test yet.
- It is not a vulnerability scanner and does not know about anything published after the verified date.
- No WordPress, Laravel or other frameworks yet, because we only list what we verified.
Building with Next.js?
The Next.js + Supabase + Stripe Agent Rules Kit adds a security-patching rule that makes your agent check next and sharp versions, block SVG uploads and run npm audit before deploy, plus a 13-point pre-deploy audit. This skill is free either way.
FAQ
Does the skill change my project?
No. It reads manifests and lockfiles and reports. It must not upgrade, install, delete, rotate or revoke anything unless you say yes to that specific change.
How current is the table?
It was last verified on 2026-10-23 against the official pages linked below. The skill tells the agent to warn you at the top of its report if that date is more than 7 days old, and to check the sources.
Why won't the agent rotate my tokens after a bad package?
For tensorlake 0.5.144, the vendor says the malware installs a service that can delete the home directory if the stolen GitHub token is revoked, so that service has to be removed first. That is a decision for you, not an agent working alone.
Does a clean report mean I'm secure?
No. It means nothing matched the six items in the table. It is not a vulnerability scanner.
Does it cover WordPress, Laravel or other frameworks?
Not yet. We only list what we verified from official sources.
Has this been tested?
The text and table were checked against the linked sources on 2026-10-23. It has not been run against real projects in a live test, so treat the first run as a trial and read the report critically.