사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/transilienceai/communitytools --skill cve-risk-score시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
CVE Risk Score
Fetch and display CVE risk scores from the National Vulnerability Database (NVD) whenever a CVE ID appears in conversation.
Trigger
This skill MUST be invoked automatically whenever a CVE ID (pattern CVE-YYYY-NNNNN) is mentioned by the user or discovered during research/scanning. Do not wait for explicit invocation.
Workflow
- Extract CVE IDs from the user's message or tool output (regex:
CVE-\d{4}-\d{4,}) - Run the lookup script:
bash
python3 tools/nvd-lookup.py CVE-XXXX-XXXXX [CVE-YYYY-YYYYY ...]- Present the results in a concise table format:
| CVE ID | Score | Severity | CWE | Description |
|---|---|---|---|---|
| CVE-XXXX-XXXXX | 9.8 | CRITICAL | CWE-79 | ... |
- Continue with the user's original task — the score lookup is supplementary context, not a blocking step.
Output Format
When presenting CVE risk scores inline, use this compact format:
CVE-2024-12345: 9.8 CRITICAL (CWE-79) — Remote code execution via ...For multiple CVEs, use a markdown table.
Rules
- Always invoke — every CVE ID mentioned triggers a lookup. No exceptions.
- Non-blocking — fetch scores in parallel with other work when possible.
- Accurate data only — display exactly what NVD returns. Never estimate or fabricate scores.
- Graceful degradation — if NVD is unreachable or the CVE has no score yet, say so explicitly (e.g., "Not yet scored by NVD").
- Rate limiting — the script handles rate limits internally. For bulk lookups (5+), warn that NVD throttles unauthenticated requests.
- API key — if
NVD_API_KEYis set in.env, the script uses it for higher rate limits.
Integration
This skill complements other skills:
- cve-poc-generator: After seeing the risk score, the user may want a full PoC and report
- reconnaissance / source-code-scanning: When these skills discover CVEs in dependencies, auto-lookup their scores
- coordination: CVE scores inform priority and severity classification in findings
