w3bs.AccountStart building
PACKAGES / Daniel Miessler

Fabric

Open source framework and CLI that applies a library of crowdsourced AI prompt patterns to text.

ThreatCrush · No malware found
INSTALLw3bs install github.com/fabric

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install github.com/fabricInstall Fabric and track it for updates
  2. fabric --setupConfigure AI providers, API keys and default model
  3. fabric --listpatternsList all available prompt patterns
  4. fabric -u <url> -p analyze_claimsFetch a web page and run a pattern on it
  5. fabric -y "<youtube-url>" --stream --pattern extract_wisdomPull a YouTube transcript and extract key insights

Every option: fabric --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in Fabric 1.4.562. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-02 22:58 UTC · threatcrush 0.13.30
Files
896 (installer + github.com/danielmiessler/Fabric@00a653f01ce5)
Findings
2 high · 11 medium · 6 low
19 other findings (not malware)
  • high
    eval on an expanded stringsource/completions/setup-completions.sh:53sh-eval-expansion · CWE-78
  • high
    Hardcoded Credentialsource/web/README.md:113secret-generic-credential · CWE-798
  • medium
    SQL assembled by concatenation or interpolationsource/cmd/generate_changelog/internal/cache/cache.go:272sql-string-concatenation · CWE-89
  • medium
    JSON Web Tokensource/data/patterns/write_nuclei_template_rule/system.md:414secret-jwt · CWE-798
  • medium
    exec.Command invoking a shellsource/internal/plugins/template/extension_executor.go:52go-shell-exec-command · CWE-78
  • medium
    stack trace returned to the callersource/scripts/python_ui/streamlit.py:161py-stack-trace-returned · CWE-209
  • medium
    stack trace returned to the callersource/scripts/python_ui/streamlit.py:492py-stack-trace-returned · CWE-209
  • medium
    stack trace returned to the callersource/scripts/python_ui/streamlit.py:940py-stack-trace-returned · CWE-209
  • medium
    stack trace returned to the callersource/scripts/python_ui/streamlit.py:1277py-stack-trace-returned · CWE-209
  • medium
    stack trace returned to the callersource/scripts/python_ui/streamlit.py:1316py-stack-trace-returned · CWE-209
  • medium
    stack trace returned to the callersource/scripts/python_ui/streamlit.py:1350py-stack-trace-returned · CWE-209
  • medium
    stack trace returned to the callersource/scripts/python_ui/streamlit.py:1374py-stack-trace-returned · CWE-209
  • medium
    unescaped HTML renderingsource/web/src/lib/services/transcriptService.ts:11js-unescaped-html-sink · CWE-79
  • low
    Hardcoded Credentialsource/docs/DigitalOcean-Agents-Setup.md:26secret-generic-credential · CWE-798
  • low
    AWS Access Keysource/internal/plugins/ai/bedrock/bedrock_test.go:88secret-aws-access-key · CWE-798
  • low
    AWS Access Keysource/internal/plugins/ai/bedrock/bedrock_test.go:115secret-aws-access-key · CWE-798
  • low
    Hardcoded Credentialsource/internal/plugins/ai/bedrock/bedrock_test.go:178secret-generic-credential · CWE-798
  • low
    OpenAI API Keysource/internal/server/mask_test.go:12secret-openai-key · CWE-798
  • low
    Generic API Keysource/internal/server/recovery_test.go:20secret-generic-api-key · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/github.com/fabric/badge.svg)](https://w3bs.org/packages/github.com/fabric)