
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@spideriq/skills
Advanced tools
SpiderIQ AI-agent skills — versioned skill files (rules, recipes, references) installed by `spideriq skills add` into a project. Ships the spiderpublish (CMS) and spiderflows (lead / local-business pipelines) skills.
Versioned AI-agent skills for SpiderIQ projects. The CLI command spideriq skills add reads this package's manifest and copies its contents into a project so AI agents (Claude Code, Cursor, Windsurf) have current, in-sync agent rules, references, and workflow recipes.
This package ships more than one skill. The manifest (dist/skills.json) is a flat list of file entries; an entry's name is the handle you pass to spideriq skills add <name>, and a single name may map to many files — that is how a multi-file skill installs as one unit.
spiderpublish — SpiderPublish CMS (flat per-file entries)| Logical name | Kind | Lands at |
|---|---|---|
claude-md | rule | CLAUDE.md (project root) |
cursor-rules | rule | .cursor/rules/spiderpublish.md |
build-a-homepage | recipe | .spideriq/recipes/build-a-homepage.md |
add-a-component | recipe | .spideriq/recipes/add-a-component.md |
swap-a-hero-block | recipe | .spideriq/recipes/swap-a-hero-block.md |
clone-a-site | recipe | .spideriq/recipes/clone-a-site.md |
add-a-domain | recipe | .spideriq/recipes/add-a-domain.md |
design-a-form | recipe | .spideriq/recipes/design-a-form.md |
spiderflows — SpiderIQ flow pipelines (one 4-layer skill, 20 files)A single skill installed as a group: every entry shares the name spiderflows, so one command installs the whole 4-layer tree, preserving its layout.
| Logical name | Kind | Lands at |
|---|---|---|
spiderflows | rule / config | .spideriq/skills/spiderflows/ — SKILL.md (router) + references/ + flows/maps-site-verify-vayapin/{recipes,learnings,scripts}/ + client/schema.yaml (20 files) |
spideriq skills add spiderflows # installs all 20 files under .spideriq/skills/spiderflows/
The router's links are relative, so the whole folder resolves once installed. spiderflows entries are kind: rule|config (never recipe), keeping them out of the SpiderPublish-scoped listRecipes() / MCP list_recipes surface.
The full mapping lives in dist/skills.json.
Indirect (the typical path):
spideriq skills add # install everything (both skills)
spideriq skills add spiderflows # install just the spiderflows skill
spideriq skills update # refresh after a new package release
Direct (@spideriq/skills consumed from another tool):
import { loadManifest, listRecipes, findEntries, readEntryContent } from '@spideriq/skills';
const manifest = loadManifest();
const recipes = listRecipes(); // SpiderPublish recipes (kind === 'recipe')
const text = readEntryContent(recipes[0]);
const flows = findEntries('spiderflows'); // all 20 files of the spiderflows skill
CLAUDE.md per starter goes stale within months.spideriq skills update re-installs the latest.list_recipes and get_recipe so an agent without local files still has access.MIT
FAQs
SpiderIQ AI-agent skills — versioned skill files (rules, recipes, references) installed by `spideriq skills add` into a project. Ships the spiderpublish (CMS) and spiderflows (lead / local-business pipelines) skills.
The npm package @spideriq/skills receives a total of 18 weekly downloads. As such, @spideriq/skills popularity was classified as not popular.
We found that @spideriq/skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.