Low Severity
Published: Oct 25, 2026
Agent skill: am i cooked? Checks your lockfiles against live CVE data (npm, pnpm, yarn, pip, poetry, pub), then fixes safely on a branch.
<div align="center">
# am-i-cooked
### New CVEs drop every day. This skill tells you if you're cooked, then fixes it.
[](https://github.com/noushiFlex/am-i-cooked/actions/workflows/test.yml)
[](LICENSE)
[](package.json)
[](skills/am-i-cooked/scripts/scan.mjs)
<code>npx skills add noushiFlex/am-i-cooked</code>
</div>
<p align="center"><img src="docs/demo.svg" alt="am-i-cooked printing a COOKED verdict and an upgrade plan" width="820" /></p>
Ask your coding agent **"am i cooked?"**. It reads your lockfiles, matches the exact versions you run against live vulnerability data, and answers with a verdict, a risk score and an upgrade plan. If you say yes, it upgrades on a separate branch, runs your tests after each step, re-scans to prove the CVEs are gone, and stops before pushing.
[Install](#install) · [What you get](#what-you-get) · [Use it without an agent](#use-it-without-an-agent) · [CI](#in-ci) · [Supported lockfiles](#supported-lockfiles) · [Safety](#safety) · [FAQ](#faq)
## What you get
- **One pass over 12 ecosystems and 18 lockfile formats**: npm, pnpm, yarn, bun, pip, poetry, uv, pub (Flutter/Dart), Cargo, Go, Bundler, Composer, Gradle, NuGet, Hex, Swift and Haskell.
- **Exact versions, not ranges.** It reads what is installed (the lockfile), not what your manifest allows.
- **A verdict you can act on**: `safe`, `a bit cooked`, `cooked`, or `unknown` when nothing could be checked. It never says safe on an empty scan.
- **A risk score (0-100)** that separates **known exploited** (CISA KEV, EPSS, public exploit) from **theoretical**.
- **One target version per package**, with a safer in-majo