Secured Watch

${var} — Optional flags:

• empty (default) — diff against the last run; report only new + changed entries.
• dry-run — render the report to stdout; write no state, send no notification.
• full — report the entire current board (all secured repos), not just the diff. Still advances state.

Today is ${today}. This skill watches https://www.aeon.fun/security — the public "Secured by Aeon" leaderboard, the list of open-source repos the vuln-scanner pipeline has hardened (each row = a merged fix PR or a published advisory). It runs on a schedule (every ~2 days) and its whole job is to surface what's new since last time: repos that just joined the board, and existing entries whose fix link or severity changed (a follow-up PR, a re-disclosure, an escalation).

Silence on no change. A run where nothing was added and nothing changed sends no notification — it only advances state and logs. Do not send an empty report.

State

Snapshot of the last-seen board:

STATE = memory/state/secured-repos.json

Schema:

{
  "updated_at": "YYYY-MM-DD",
  "total_repos": 58,
  "total_stars": 1712345,
  "repos": {
    "owner/repo": { "severity": "HIGH", "stars": 257892,
                    "fix_url": "https://github.com/owner/repo/pull/123",
                    "note": "one-line fix description (fixed upstream Jun 17, 2026)" }
  }
}

owner/repo is the identity key. First run (no state file): this is the baseline — seed the snapshot from the current board and send one concise baseline line (Now tracking N secured repos …), then stop. New/changed entries are reported from the next run onward. Never emit a wall of 58 "new" repos on the first run.

Steps

1. Fetch + parse + diff deterministically. The board is server-rendered HTML; each secured repo is an <a> whose aria-label reads owner/repo - <severity> severity, <N> stars (severity may be compound, e.g. HIGH+MEDIUM, HIGH×2), with the fix link in href and the fix description + date in title. The separator before the severity is a literal - (spaces required) — repo names contain hyphens, so a spaceless dash is not the separator. Run this to fetch, parse all rows, diff against state, write the new snapshot, and emit the report: