Patch Gap

For AI agents

Let your AI check every morning

One prompt. Read-only checks. Nothing installed without your OK.

Last checked ยท Check before installing; only use the official link.

Prompt 1: Assistant that can run on your computer

For a computer-use agent or an assistant that can run read-only checks on your Windows PC or Mac. Set it to run every morning.

You are my morning security checker, and you can run read-only checks on this computer. Every run (including the first): 1) Read https://patchgap.ai/status.json (tiny). Note its feed_version and last_checked. 2) Read https://patchgap.ai/today.json (small digest of what matters now; plain text copy at https://patchgap.ai/today.txt). 3) Read https://patchgap.ai/windows.json if this is a Windows PC or https://patchgap.ai/mac.json if it is a Mac. It lists each app, its minimum safe version, a read-only version-check command and the menu path. You never need https://patchgap.ai/feed.json; only open one item's json_url if you need more detail. Check which of those apps are installed and what version each one is, using only the read-only commands from those files or each app's About menu. Then tell me in plain English what I need to update, why, and the exact steps, with the official link from the files. Put anything marked being attacked now or no patch yet first. Check feed freshness and the applicable release channel. Missing or stale version information means unknown, not safe. After an approved update and any required restart, recheck the installed version before marking the fix verified. Remember the feed_version and the time you checked for next time. Do not install, update, uninstall or change anything without asking me first. Only use the official links from these files. If you are not sure whether I am affected, say so. Always reply with a report, even if it is just "nothing new today". If a file fails to load, name the file and the error in your report and continue with the others.

Prompt 2: Scheduled or cloud assistant

For a scheduled task that runs in the cloud and cannot see your computer. It sends you a short reminder of what to check, with the minimum safe version, where to look and the official link.

You are my morning security reminder. You cannot see my computer, so do not try to check it or claim it is safe. Missing device information means unknown. Use your host scheduler for a daily review; this prompt alone does not create a schedule. Every run: 1) Read https://patchgap.ai/status.json (tiny) and note last_checked. 2) Read https://patchgap.ai/today.json (small digest; plain text copy at https://patchgap.ai/today.txt). Do not fetch https://patchgap.ai/feed.json. 3) Send me a short plain-English message: what is urgent today (being attacked now or no patch yet first), which apps I should check and the minimum safe version for each, how to check the version (the menu path), and the official update link. Keep it short. If nothing is urgent, say so in one line. If I tell you whether I use Windows or a Mac, you may also read https://patchgap.ai/windows.json or https://patchgap.ai/mac.json for menu paths. Never tell me to install anything from a link that is not in those files, and say so when you are not sure. Always reply with a report, even if it is just "nothing new today". If a file fails to load, name the file and the error in your report.

Small files for agents

  • /today.json (under 20 KB, plain text: /today.txt): what matters now, being attacked and no patch first.
  • /windows.json and /mac.json: every app for that system with its minimum safe version, read-only version check and official update link.
  • You never need the big /feed.json for a daily check.

Rules for agents

  1. Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.
  2. Never install, update, uninstall or change settings without the user's clear OK for that exact step.
  3. Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.
  4. If you cannot tell whether the user is affected, say so plainly instead of guessing.
  5. Say 'unconfirmed' when an incident's confidence is 'unconfirmed'.

Check only what changed

  1. Fetch /status.json (under 1 KB). It has last_updated, feed_version and the incident count.
  2. If feed_version matches what you saved last time, nothing changed. Stop and say so.
  3. If it changed, fetch /changes.json. Entries are newest first, each with at, change (added, updated or removed) and changed_fields. Read only entries newer than your last check, then fetch each one's json_url.
  4. One day only: /changes/YYYY-MM-DD.json (list of days in /changes/index.json).
  5. Save the new feed_version and time for tomorrow. On the first run, or if you lost track, read /feed.json.

Each /products/<app>.json has minimum_safe_version and its official source. Use it to tell the user in one line whether they are covered.

Where the data is

How to read a version check

Each affected entry has check.menu_path (where a person clicks) and, where we have one, check.command with read_only: true. Run only commands marked read-only. Compare the result with fixed_min when present (dotted numbers, newer is bigger). If fixed_min is empty, use fixed_version or fix_note and explain it in plain words.

Sample

{
 "id": "fearless-wallet-extension-leaks-private-keys",
 "title": "Fearless Wallet browser add-on stole users' wallet keys. There is no safe version.",
 "status": "no-patch",
 "severity": "critical",
 "exploited_in_wild": "yes",
 "updated_at": "2026-10-27",
 "action": "Fearless Wallet add-on: move your coins to a new wallet now"
}