cve-source-check

Featured

Audit CVE/vulnerability source coverage for a technology stack. Maps each component (container, library, base image, runtime) to authoritative CVE feeds, flags gaps, and produces audit-ready reports. Generic: works for any service or stack.

AI & Automation 412 stars 42 forks Updated 2 days ago MIT

Install

View on GitHub

Quality Score: 96/100

Stars 20%
87
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# CVE Source Check Audits CVE/vulnerability source coverage for a technology stack. Given an inventory of components and (optionally) the feeds you currently monitor, it maps each component to authoritative CVE sources, flags gaps, and emits audit-ready reports. ## Scope | In scope | Out of scope | |---|---| | Mapping components → authoritative feeds via a versioned registry | Running vulnerability scanners (Trivy/Snyk/etc.) | | Reporting coverage and gaps in JSON + Markdown | Fetching CVE content or ranking by severity | | Optional HEAD-check for source URL reachability | Integrating with private/commercial vuln databases | | Audit-ready output (deterministic, reproducible) | Live LLM research per run | ## Inputs | Flag | Purpose | |---|---| | `--inventory <file>` | JSON inventory: `[{name, version?, type?}, ...]` or `{components: [...]}`. | | `--inline "name@ver,name,..."` | Quick comma-separated list. Mutually exclusive with `--inventory`. | | `--current-sources <file>` | Optional. One URL per line. Blank lines and `#` comments skipped. | | `--service <name>` | Free-form name used in report header and filenames. | | `--check-urls` | HEAD-check every source URL (5s timeout, graceful degradation). | | `--registry <path>` | Override default `tech-source-registry.json`. | | `--out-dir <path>` | Output directory (default: cwd). | JSON inventory format only. YAML is not supported — stdlib does not ship a YAML parser. ## Outputs | File | Format | |---|---| | `cve-source-r...

Details

Author
notque
Repository
notque/vexjoy-agent
Created
4 months ago
Last Updated
2 days ago
Language
Python
License
MIT

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Featured

cve-scan

Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart). Triggers: CVE scan, vulnerability scan, npm audit, pip audit.

161 Updated today
softspark
AI & Automation Solid

cyber-audit

Read-only exposure audit of THIS MACHINE against a specific external advisory — a named CVE, malicious package, or supply-chain advisory — then write a report. Invoke only when the user explicitly asks whether THIS MACHINE is affected by a named CVE/package/advisory ("am I affected by X", "is this package/CVE on my system", "scan my machine for Y"). Do not invoke merely because an advisory/CVE/package is mentioned, for an explanation or news summary, for code/repo/appsec review, or for account/credential-breach response.

3 Updated today
hcaiano
AI & Automation Listed

vuln-scan

Use this skill when the user runs /ievo:vuln-scan, asks to scan for vulnerabilities, or says "security scan my code" — not for auditing a third-party skill/plugin before installation (use /ievo:security-check for that). CWE-aware deep source code vulnerability scan for a single module or file set, inspired by Project Glasswing. Uses AI reasoning (not regex) to trace data flows, detect vulnerabilities, and validate findings via complete exploit chains. Every finding requires an attack narrative (entry point, data flow, impact); no chain means no finding. Applied per-module by the vuln-scanner agent, orchestrated by the /ievo:vuln-scan command. Covers OWASP top 10, CWE-anchored threat taxonomy (injection, auth bypass, crypto misuse, data exposure, race conditions, deserialization, path traversal, SSRF, business logic, supply chain).

0 Updated today
ievo-ai