cve-risk-score
starsforks
How to install cve-risk-score?
transilienceai/communitytools/cve-risk-score
$npx -y skills add transilienceai/communitytools --skill cve-risk-scoreRetrieve CVE risk scores from NVD. Auto-invoked whenever a CVE ID is mentioned to display CVSS score, severity, CWE, and description.
SKILL.md
| 1 | # CVE Risk Score |
| 2 | |
| 3 | Fetch and display CVE risk scores from the National Vulnerability Database (NVD) whenever a CVE ID appears in conversation. |
| 4 | |
| 5 | ## Trigger |
| 6 | |
| 7 | This skill MUST be invoked automatically whenever a CVE ID (pattern `CVE-YYYY-NNNNN`) is mentioned by the user or discovered during research/scanning. Do not wait for explicit invocation. |
| 8 | |
| 9 | ## Workflow |
| 10 | |
| 11 | 1. **Extract CVE IDs** from the user's message or tool output (regex: `CVE-\d{4}-\d{4,}`) |
| 12 | 2. **Run the lookup script**: |
| 13 | ```bash |
| 14 | python3 tools/nvd-lookup.py CVE-XXXX-XXXXX [CVE-YYYY-YYYYY ...] |
| 15 | ``` |
| 16 | 3. **Present the results** in a concise table format: |
| 17 | |
| 18 | | CVE ID | Score | Severity | CWE | Description | |
| 19 | |--------|-------|----------|-----|-------------| |
| 20 | | CVE-XXXX-XXXXX | 9.8 | CRITICAL | CWE-79 | ... | |
| 21 | |
| 22 | 4. **Continue with the user's original task** — the score lookup is supplementary context, not a blocking step. |
| 23 | |
| 24 | ## Output Format |
| 25 | |
| 26 | When presenting CVE risk scores inline, use this compact format: |
| 27 | |
| 28 | ``` |
| 29 | CVE-2024-12345: 9.8 CRITICAL (CWE-79) — Remote code execution via ... |
| 30 | ``` |
| 31 | |
| 32 | For multiple CVEs, use a markdown table. |
| 33 | |
| 34 | ## Rules |
| 35 | |
| 36 | 1. **Always invoke** — every CVE ID mentioned triggers a lookup. No exceptions. |
| 37 | 2. **Non-blocking** — fetch scores in parallel with other work when possible. |
| 38 | 3. **Accurate data only** — display exactly what NVD returns. Never estimate or fabricate scores. |
| 39 | 4. **Graceful degradation** — if NVD is unreachable or the CVE has no score yet, say so explicitly (e.g., "Not yet scored by NVD"). |
| 40 | 5. **Rate limiting** — the script handles rate limits internally. For bulk lookups (5+), warn that NVD throttles unauthenticated requests. |
| 41 | 6. **API key** — if `NVD_API_KEY` is set in `.env`, the script uses it for higher rate limits. |
| 42 | |
| 43 | ## Integration |
| 44 | |
| 45 | This skill complements other skills: |
| 46 | - **cve-poc-generator**: After seeing the risk score, the user may want a full PoC and report |
| 47 | - **reconnaissance / source-code-scanning**: When these skills discover CVEs in dependencies, auto-lookup their scores |
| 48 | - **coordination**: CVE scores inform priority and severity classification in findings |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
