Getting started

stackalarm is an agent skill and the CLI it relies on. You install the skill; it installs the CLI with your agreement, then answers one question about the project in front of it: is there anything in this week's security news that affects us, and what should we do?

Install

npx skills add yoanbernabeu/stackalarm

This works with Claude Code, Codex, Cursor and the other agents the skills installer supports. The first time you run /stackalarm, the skill checks for the CLI and, when it is missing, offers to install it with the command that fits your machine. Nothing runs before you agree.

To install the CLI yourself instead:

Homebrew (macOS, Linux)

brew install yoanbernabeu/tap/stackalarm

Install script (macOS, Linux)

curl -sSL https://raw.githubusercontent.com/yoanbernabeu/stackalarm/main/install.sh | sh

The script needs no sudo: it installs in /usr/local/bin when it can write there, otherwise in ~/.local/bin, and checks the archive against the release checksums. Set STACKALARM_VERSION to pick a version and INSTALL_DIR to pick the folder. On Windows, download the zip from the releases, or use Go:

go install github.com/yoanbernabeu/stackalarm/cmd/stackalarm@latest

Two optional keys

stackalarm works without any key. Two environment variables make it fuller and faster:

Variable	What it changes
`GITHUB_TOKEN` or `GH_TOKEN`	Lifts the GitHub API cap. 26 sources go through it (the GitHub Advisory Database per ecosystem, and the security advisories of projects such as Astro or Next.js); only those matching your tags are read. Anonymous requests are capped at 60 per hour per IP: past that, those sources fail, and the output says so. Any token works, with no permission at all: the data is public.
`NVD_API_KEY`	NVD searches go from one request every 6 seconds to about one every 0.7 seconds. Request a key, it is free.

If you use the GitHub CLI, your existing login is enough:

export GITHUB_TOKEN=$(gh auth token)

When GitHub sources fail on the cap and gh is logged in, the skill offers to run the CLI again this way. The token is only sent to api.github.com.

Run a check

Open a project in your agent and call the skill by name. Anything you add after it becomes the focus of the check:

/stackalarm
/stackalarm before the Friday deploy
/stackalarm are we affected by PHP2Shell?

In agents without slash commands, ask for it by name: "use the stackalarm skill". Calling it explicitly matters: asked "any security flaws to fix?", agents tend to run npm audit or composer audit on their own, which only see library advisories and know nothing of this week's runtime flaws or announced releases.

Read the answer

The answer comes in your language, verdict first, then the findings grouped by urgency. Empty groups are left out.

Part	What it holds
Verdict	One sentence: nothing to do, prepare for X, or act today on Y.
Act now	The project is affected: what, why (the version and the file it comes from), the fix, a mitigation, the source.
Prepare / plan	A heads-up, an end of support, or a fix to plan without urgency.
Good to know	Context that does not call for action.
Checked / Not checked	The tags, keywords, searches and audits used, and what could not be checked: a source that failed, a missing tool, an unknown production version.

Then the agent offers to fix what lives in the repository (a runtime image, a dependency, a documented mitigation), one change at a time and only after you agree. It never pushes, deploys or touches a server: what lives elsewhere is explained for you to do. See the skill for how it decides.

Keep watch

At the end of a check, the agent offers to set up the scheduled watch: the same news, read every 4 hours in GitHub Actions or GitLab CI, with an issue when something new concerns the project.

Next: The skill