
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
@cnbcool/cnb-cli
Advanced tools
CNB 平台技能集合,在一个仓库中维护多个 CodeBuddy Skill,可通过 npx skills 便捷安装。
npx skills add https://cnb.cool/cnb/skills/cnb-skill.git --agent codebuddy -y
# 列出所有可用的 Skill
npx skills add https://cnb.cool/cnb/skills/cnb-skill.git --list
# 安装单个 Skill
npx skills add https://cnb.cool/cnb/skills/cnb-skill.git --skill cnb-api --agent codebuddy -y
# 安装多个指定 Skill
npx skills add https://cnb.cool/cnb/skills/cnb-skill.git --skill cnb-api --skill code-review --skill pr-diff --agent codebuddy -y
npm install @cnbcool/cnb-cli -g
安装完成后运行 cnb --help 验证是否安装成功。
将以下提示词复制后发送给 AI 智能体(如 CodeBuddy),即可自动完成所有安装:
请帮我安装 CNB Skills 的运行环境,依次执行以下步骤:
1. 全局安装 cnb-cli:
npm install @cnbcool/cnb-cli -g
安装完成后运行 cnb --help 验证是否安装成功。
2. 全局安装 skills 工具:
npm install skills -g
3. 通过 skills 工具安装所有 skill 到当前工作目录:
npx skills add https://cnb.cool/cnb/skills/cnb-skill.git --agent codebuddy -y --copy
每一步执行完后告诉我结果,如果有报错请帮我解决。
https://api.cnb.coolmainCNB、云原生构建、组织、代码仓库、Issue、PR、合并请求、流水线、代码评审、CI/CD
FAQs
CNB OpenAPI 命令行工具,基于 CNB 平台 Swagger 自动生成,支持 Issues、PR、Git、组织管理等全部 API 操作
We found that @cnbcool/cnb-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.