
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@nomark-ai/skills
Advanced tools
Portable Claude Code skills from the Nomark harness — design, cloud, data, security, and quality packs with no governance coupling.
Portable Claude Code skills extracted from the Nomark harness — the design,
cloud, CI/CD, data-engineering, LLM/RAG, security, quality, and business
packs that work in any repository. Everything wired to nomark governance
machinery (/allocate, /autopilot, trust ledger, instinct learning) is
excluded; those skills only make sense inside a nomark-governed repo and ship
with @nomark-ai/method instead.
claude plugin marketplace add @nomark-ai/skills # or the npm-installed path
claude plugin install nomark-skills@nomark-skills-marketplace --scope user
User scope makes the skills available in every repo on the machine and in Claude Code cloud sessions.
Built by scripts/build-skills.cjs from the canonical harness at
packages/method/nomark_v2/code/claude-harness/skills/. The set is derived,
not hand-maintained: a skill ships unless its SKILL.md references repo-local
machinery (scripts/*.cjs, .nomark/, governance docs) or it sits on the
explicit denylist of harness-internal skills. Two governance boilerplate
blocks (the CHARTER header and the F-065 allocation paragraph) are stripped
from shipped copies because they instruct sessions to run scripts that only
exist in nomark repos.
npm run build # regenerate plugin/skills/ from the live harness
npm test # verify the committed payload matches a fresh build
The built payload under plugin/skills/ is committed so reviewers can see
exactly what npm publishes.
FAQs
Portable Claude Code skills from the Nomark harness — design, cloud, data, security, and quality packs with no governance coupling.
We found that @nomark-ai/skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.