stackalarm

stackalarm is an agent skill and companion CLI by Yoan Bernabeu. Run /stackalarm in an agent such as Claude Code, Codex or Cursor, and it answers which of this week's security news affects the current repository, how urgent it is, and what to change. It is open source under the MIT license; the latest release listed is v0.7.0.

What It Is

stackalarm splits the job into two parts. The skill acts as the analyst: it reads the project (manifests, lockfiles, Dockerfiles, CI, git remotes), runs the CLI, supplements it with a web search and ecosystem audits such as composer audit, npm audit, pip-audit and govulncheck, and decides what applies. The CLI acts as its eyes: it reads 181 sources first-hand, per the homepage, and does no project analysis itself.

The answer comes verdict first, then findings grouped by urgency (Act now, Prepare/plan, Good to know), plus a Checked / Not checked list. The skill offers to fix what lives in the repository, one change at a time and only after asking. It never pushes, deploys or touches a server.

Sources and Signal Stages

Sources include project and vendor announcements, the GitHub Advisory Database, the NVD and EUVD CVE databases, CERTs from the US, Europe, Canada and Japan, CISA KEV, exploit databases and the security press. Each item is tagged with a stage: heads-up, release, advisory, alert or news. A source that cannot be read is always listed in the output. The CLI can also be used standalone, for example stackalarm news --tag php --since 7d.

Scheduled Watch in CI

The agent can write a .stackalarm.yaml profile of tags, keywords, packages and stack. A GitHub Actions workflow or GitLab CI job then runs the CLI every four hours and opens an issue when a heads-up, alert or security release concerns the stack. On GitHub, with an ANTHROPIC_API_KEY secret, Claude triages the news first and opens an issue only when the project is concerned.

Setup and Privacy

Install the skill with npx skills add yoanbernabeu/stackalarm; on first run it offers to install the CLI and runs nothing before you agree. The CLI can also be installed via Homebrew, an install script, a Windows zip, or go install. It works without keys; GITHUB_TOKEN and NVD_API_KEY are optional. The CLI sends only tags, keywords and package names to public databases, and the project states there is no telemetry.