Safety this week

Every repo scanned on 2 Nov 2026. No malicious packages found. 32 of the 35 Caution labels include a critical-severity advisory in a runtime dependency.

With a critical advisory: 32of 52
Critical advisories: 347
Pipe-to-shell agent files: 7

12535

No issues found 12 No dependencies scanned 5 Caution 35 Risk found 0

What “critical” means here

“Critical” is the advisory’s own severity in OSV, not proof that the tool is exploitable in your setup. Each advisory counts once per package per tool. Caution means “check before you rely on it”, not “malware”.

All 52 tools, one tile each

Sorted by label, then by critical advisories.

wshobson/agentsNo issues found
codex-plugin-ccNo issues found
FirecrawlNo issues found
GitHub MCP ServerNo issues found
LangGraphNo issues found
magpieNo issues found
MastraNo issues found
OpenCodeNo issues found
Playwright MCPNo issues found
MCP reference serversNo issues found
skill-recorderNo issues found
Agent SkillsNo issues found
awesome-mcp-serversNo dependencies scanned
Claude CodeNo dependencies scanned
MarkItDownNo dependencies scanned
smolagentsNo dependencies scanned
SuperpowersNo dependencies scanned
LlamaIndex39 critical
Continue36 critical
AutoGen33 critical
Crawl4AI29 critical
Aider18 critical
Mem018 critical, pipes to shell
AutoGPT16 critical
Cline13 critical
Open WebUI13 critical
Remotion13 critical
Roo Code13 critical, archived
llama.cpp12 critical
Gemini CLI9 critical, pipes to shell
STORM9 critical
CrewAI8 critical
goose8 critical, pipes to shell
GPT Researcher8 critical
artemis7 critical
deepseek-harness7 critical
LangChain7 critical
OpenBot5 critical
Codex4 critical
LobeHub3 critical
n8n3 critical
OpenAI Agents SDK (Python)3 critical
RAGFlow3 critical
Agent Development Kit (ADK, Python)2 critical, pipes to shell
Context72 critical
KiroCrew2 critical
Ollama2 critical
Dify1 critical
Pydantic AI1 critical
Browser Use0 critical, pipes to shell
OpenHands0 critical, pipes to shell
vLLM0 critical, pipes to shell

Most critical advisories

Distinct critical-severity advisories in runtime dependencies (OSV).

Critical advisoriesper tool

1LlamaIndexRAG, knowledge & memory39
2ContinueCoding agents36
3AutoGenAutomation & agent frameworks33
4Crawl4AIResearch & web data29
5AiderCoding agents18
6Mem0RAG, knowledge & memory18
7AutoGPTAutomation & agent frameworks16
8ClineCoding agents13

All 32 tools with a critical advisory

Totals and the week before

This week's safety watch: Week 45 · 2026

Scanned 2 Nov 2026 · 52 tracked AI and agent tools (open-source, source-available and proprietary) · automated scan, not a manual audit · compared with 2026-W44

Tools with at least one critical-severity dependency vulnerability (OSV): 32/52
Distinct critical-severity advisories in runtime dependencies, summed over all tools: 347
Tools whose agent or skill files tell the agent to pipe a remote script into a shell: 7
Tools with no issues found: 12/52

Labels: No issues found 12 · No dependencies scanned 5 · Caution 35 · Risk found 0 (last week 9 / 5 / 38 / 0)
32 of 52 tools have at least one known critical-severity vulnerability in runtime dependencies (last week 36), 347 distinct critical advisories in total (last week 352). Most: LlamaIndex (39), Continue (36), AutoGen (33). Each advisory counts once per package per tool, even when the same package appears in many lockfiles of a monorepo.
7 tools ship an agent or skill instruction file that tells the agent to run curl … | sh style commands (same as last week): Gemini CLI, OpenHands, Browser Use, goose, Agent Development Kit (ADK, Python), Mem0, vLLM.
31 of 52 repos document a curl | sh style installer somewhere (informational, does not change the label).
Biggest moves since 2026-W44: OpenCode label Caution → No issues found; wshobson/agents label Caution → No issues found; Mastra label Caution → No issues found; wshobson/agents critical-severity dependency advisories 6 → 0; OpenCode critical-severity dependency advisories 4 → 0.
Archived or no push in 180 days: STORM, Roo Code (archived).

Link to this summary: stackgrade.app/warnings/#this-week · raw data: items.json · how the scan works

Short answer

This week our automated scan of 52 AI and agent tools (open-source, source-available and proprietary) found that 32 have at least one known critical-severity vulnerability in their runtime dependencies (OSV, 347 distinct critical advisories in total). 7 ship an agent or skill instruction file that tells the agent to pipe a remote script into a shell: Gemini CLI, OpenHands, Browser Use, goose, Agent Development Kit (ADK, Python), Mem0 and vLLM. 12 came out with no issues found and 5 had no dependency list to check (Claude Code, Superpowers, awesome-mcp-servers, smolagents and MarkItDown). No tool got “Risk found”: we found no malicious packages. A Caution label means “check before you rely on it”, not “malware”.

Read the full answer

How to read the numbers

Each advisory counts once per package per tool. Monorepos repeat the same package in many lockfiles (4,246 raw lockfile matches this week); we count the distinct advisories.
“Critical” is the advisory's severity, not proof of exploitability in your setup.
“No issues found” is not a guarantee, and “No dependencies scanned” means there was no runtime lockfile or manifest to check.
Informational findings don't change the label, for example a README that documents a curl | sh installer.

Check a specific tool: Claude Code · Gemini CLI · OpenCode · Cline · Ollama · llama.cpp · coding agents · MCP servers and skills · safety check

Agent files that pipe a script into a shell

When an agent follows these, it runs code from the internet with your permissions.

Changes since Week 44

OpenCodeCaution changed to No issues found
wshobson/agentsCaution changed to No issues found
MastraCaution changed to No issues found

Unmaintained signals and other events

OpenCode: Safety label changed: Caution → No issues found
wshobson/agents: Safety label changed: Caution → No issues found
Mastra: Safety label changed: Caution → No issues found

Unmaintained right now: STORM (last push 30 Sept 2025), Roo Code (archived)

All reasons, per tool

Risk found (0)

None.

Caution (35)

Codex: 4 critical-severity known vulnerabilities in runtime dependencies (OSV)
Gemini CLI: 9 critical-severity known vulnerabilities in runtime dependencies (OSV); Skill/agent file instructs piping a remote script into a shell: .gemini/skills/agent-tui/SKILL.md — curl -fsSL https://raw.githubusercontent.com/pproenca/agent-tui/master/install.sh | sh
Cline: 13 critical-severity known vulnerabilities in runtime dependencies (OSV)
Aider: 18 critical-severity known vulnerabilities in runtime dependencies (OSV)
OpenHands: Skill/agent file instructs piping a remote script into a shell: .agents/skills/frontend-development/references/guide.md — curl -LsSf https://astral.sh/uv/install.sh | sh
Continue: 36 critical-severity known vulnerabilities in runtime dependencies (OSV)
CrewAI: 8 critical-severity known vulnerabilities in runtime dependencies (OSV)
AutoGen: 33 critical-severity known vulnerabilities in runtime dependencies (OSV)
n8n: 3 critical-severity known vulnerabilities in runtime dependencies (OSV)
AutoGPT: 16 critical-severity known vulnerabilities in runtime dependencies (OSV)
Browser Use: Skill/agent file instructs piping a remote script into a shell: skills/cloud/references/quickstart.md — curl -fsSL https://browser-use.com/profile.sh | sh
GPT Researcher: 8 critical-severity known vulnerabilities in runtime dependencies (OSV)
STORM: 9 critical-severity known vulnerabilities in runtime dependencies (OSV)
Remotion: 13 critical-severity known vulnerabilities in runtime dependencies (OSV)
Ollama: 2 critical-severity known vulnerabilities in runtime dependencies (OSV)
Roo Code: 13 critical-severity known vulnerabilities in runtime dependencies (OSV); Repository archived
goose: 8 critical-severity known vulnerabilities in runtime dependencies (OSV); Skill/agent file instructs piping a remote script into a shell: crates/goose/src/skills/builtins/web_search.md — curl -LsSf https://astral.sh/uv/install.sh | sh
deepseek-harness: 7 critical-severity known vulnerabilities in runtime dependencies (OSV)
KiroCrew: 2 critical-severity known vulnerabilities in runtime dependencies (OSV)
Context7: 2 critical-severity known vulnerabilities in runtime dependencies (OSV)
OpenAI Agents SDK (Python): 3 critical-severity known vulnerabilities in runtime dependencies (OSV)
Pydantic AI: 1 critical-severity known vulnerability in runtime dependencies (OSV)
Agent Development Kit (ADK, Python): 2 critical-severity known vulnerabilities in runtime dependencies (OSV); Skill/agent file instructs piping a remote script into a shell: .agents/skills/adk-setup/SKILL.md — curl -LsSf https://astral.sh/uv/install.sh | sh
LangChain: 7 critical-severity known vulnerabilities in runtime dependencies (OSV)
Dify: 1 critical-severity known vulnerability in runtime dependencies (OSV)
OpenBot: 5 critical-severity known vulnerabilities in runtime dependencies (OSV)
artemis: 7 critical-severity known vulnerabilities in runtime dependencies (OSV)
Crawl4AI: 29 critical-severity known vulnerabilities in runtime dependencies (OSV)
LlamaIndex: 39 critical-severity known vulnerabilities in runtime dependencies (OSV)
RAGFlow: 3 critical-severity known vulnerabilities in runtime dependencies (OSV)
Mem0: 18 critical-severity known vulnerabilities in runtime dependencies (OSV); Skill/agent file instructs piping a remote script into a shell: skills/mem0-oss-to-platform/references/gotchas.md — curl -fsSL https://raw.githubusercontent.com/mem0ai/mem0/main/scripts/oss-to-platform-migrate.sh | bash
llama.cpp: 12 critical-severity known vulnerabilities in runtime dependencies (OSV)
vLLM: Skill/agent file instructs piping a remote script into a shell: AGENTS.md — curl -LsSf https://astral.sh/uv/install.sh | sh
Open WebUI: 13 critical-severity known vulnerabilities in runtime dependencies (OSV)
LobeHub: 3 critical-severity known vulnerabilities in runtime dependencies (OSV)

How to read the numbers

Monorepos repeat the same package in many lockfiles; we count distinct advisories.
“No issues found” is not a guarantee.
Informational findings, like a README with a curl | sh installer, do not change the label.

How the scan works

Get every label change by email

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.