radar-explore
Discover important work the radar does NOT yet track, by iterating the discovery-venue list in SOURCES.md every run —…
Repair a source or tool that keeps failing — a broken/moved/stale feed, a 404, an empty result, a parse/JSON error — instead of logging "degraded" forever. Diagnose the failure class, find a working access path, and record the repaired method in SOURCES.md so future runs don't
Claude Code
$ npx -y skills add Neetx/ai-security-research-radar --skill radar-source-heal --agent claude-code
Codex
$ npx skills add Neetx/ai-security-research-radar --skill radar-source-heal -a codex -y
Cursor
$ npx skills add Neetx/ai-security-research-radar --skill radar-source-heal -a cursor -y
Gemini CLI
$ npx skills add Neetx/ai-security-research-radar --skill radar-source-heal -a gemini-cli -y
GitHub Copilot
$ npx skills add Neetx/ai-security-research-radar --skill radar-source-heal -a github-copilot -y
OpenCode
$ npx skills add Neetx/ai-security-research-radar --skill radar-source-heal -a opencode -y
Windsurf
$ npx skills add Neetx/ai-security-research-radar --skill radar-source-heal -a windsurf -y
name: radar-source-heal description: | Repair a source or tool that keeps failing — a broken/moved/stale feed, a 404, an empty result, a parse/JSON error — instead of logging "degraded" forever. Diagnose the failure class, find a working access path, and record the repaired method in SOURCES.md so future runs don't repeat it. Generalizes to any future source/tool breakage. Use whenever the lab sweep, pulse, or repo-watch hits a source that failed the same way before.
Logging "degraded" run after run is a failure of the radar, not of the source. If you logged the same breakage last run (check the recent tail of `logs/source_rotation.md` and SOURCES.md notes), **fix it this run** — don't just re-log it.
Coverage-honesty means every sweep logs each source as `opened` or `degraded: <reason>` in `logs/source_rotation.md`. So the heal worklist is a precise, queryable set — you do not guess what to fix:
marked `degraded` in 2+ recent runs (or obviously degraded NOW — empty feed, 404, JSON/parse error, a feed whose newest item is months old) is OWED a heal this run. One transient blip → log it, retry next run; don't heal on a single failure.
log entirely (neither opened nor degraded — a coverage lie) is also a heal target: it is usually being skipped because it has no recorded access method and falls out of the list-iteration (this is the alphamatch failure class). Find a working method and record it.
The fix is written back into SOURCES.md (below), so the NEXT list-iteration consumes it automatically — that is what closes the loop: iterate → degraded / missing → heal → SOURCES.md method → next iteration succeeds.
**Class A — broken / moved / stale feed or page**
`<link rel="alternate" type="application/rss+xml|atom+xml">`, or try common paths: `/rss`, `/feed`, `/rss.xml`, `/atom.xml`, `/index.xml`, `/blog/feed.xml`.
confirm it resolves with recent posts.
the org now posts elsewhere; find the live channel (a different domain, their HF org activity, a docs/changelog page) and switch to it.
note it, so the sweep stops hunting for a feed.
domain before concluding the source is unreachable** (AMENDED 2026-07-25, W30 Proposal J — motivated by Bishop Fox: W27/W28 marked it unresolved after repeatedly retrying one individual post URL, when the plain `/blog` index path worked the whole time). A rendering/JS failure on one path does not mean the whole domain fails — try the bare blog/research index, `/blog`, `/research`, `/news`, or a category root before the domain is written off as JS-blocked or dead.
**Class B — failing tool call on an otherwise-live source**
`--extract-depth advanced`, smaller/larger scope.
a JSON/search API — e.g. a public search endpoint — that returns clean data without scraping).
A topic SEARCH (`tvly search "<terms>" --include-domains <site>`) returns what RANKS, not what is NEWEST. Used as the access method for a feed-less or JS-rendered site it produces confident false negatives — "checked, nothing fresh" while the site published on-scope posts the query did not rank. A search is fine as an EXTRACT aid; it can never be the CHECK that discharges a coverage promise. Heal such a source with a method that ENUMERATES what the site published, in this order: 1. its feed (find it as in Class A), else 2. the sitemap diff (`sitemap_diff.py <host>`, bundled with the sweep skill: URLs new since the last run), else 3. the index diff (`sitemap_diff.py index:<section index url>`: the article links in the index page's raw HTML), else 4. a rendered copy of the index (`tvly extract`, or a reader proxy) diffed against the URLs already in the repo. Only if all four fail is the source search-only: log it `search-only (recency not guaranteed)` — never `opened`/`checked` — and keep it on the heal worklist. Re-check every "healed" source whose recorded method is a search: it was never actually healed.
Write the WORKING access method back into `SOURCES.md` next to that source, dated, REPLACING the "degraded/404/stale" note — e.g. "feed at <url> (confirmed working YYYY-MM-DD)" or "use <endpoint>, not the feed (YYYY-MM-DD)". The registry is agent-owned; the repaired method is what makes the fix permanent. If a source is genuinely dead with no replacement, mark it `RETIRED <date> — <reason>` and drop it from the active list.
Some sources are blocked not by a broken path but by the environment — a datacenter-IP block by the site, or egress restricted to a few hosts. You cannot "repair" these, but you must NOT re-log "blocked from this IP" every run either.
like `hn.algolia.com`). If it works, the block is site-specific → switch that source to its API host (e.g. HN → `hn.algolia.com/api/v1/...`; HF → the `huggingface.co/api/...` endpoints; Reddit → the `.js
Autonomous tracker of the offensive AI-security frontier — AI for offense and attacks against AI — for a security researcher; generated from TRENDS.md.
Discover important work the radar does NOT yet track, by iterating the discovery-venue list in SOURCES.md every run —…
Sweep the primary security feeds — vendor/lab red-team & security blogs, research venues, and advisory feeds — on EVERY daily run…
Safely update TRENDS.md (the AI Security Radar ledger): append evidence, move stages, manage observation_queue, source_rotation…
Iterate the FULL social/community + trusted-curator source lists in SOURCES.md (Reddit, Hacker News, YouTube curators,…
Regenerate README.md, the repo's landing page and only output surface: badges, a 3-4 bullet "since last scan" digest with inline…
Watch GitHub every daily run for behind-the-scenes movement — across watched REPOS (releases, merged PRs, hot issues), watched…
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…