Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →automateyournetwork/cisco-psirt-advisories
Check whether a running Cisco software version is affected by a published PSIRT security advisory - by OS version, CVE, or advisory ID, with severity and CVSS. Covers IOS, IOS-XE, NX-OS, ASA, FTD, FMC and ACI.
Passed 11 of 16 test cases with the skill, and 7 of 16 without it.
and 3 more in the full report
5 fixed10 passed either way7 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
We need to check whether Cisco has published an official security advisory for CVE-2024-20353, and also find its generic NVD CVSS score. Which tool should handle the Cisco advisory lookup?
| Checked | Without skill | With skill |
|---|---|---|
| Directs the Cisco advisory query to Cisco PSIRT check_cve. | Missed | Passed |
The instructions your model reads when the skill loads.
Answers one question well: is the software this device is running affected by a Cisco security advisory?
Every tool returns one of five outcome values. Two of them look similar in the data
and mean completely different things:
outcome | What it means |
|---|---|
advisories_found | Cisco has published advisories for this version |
none_published | Cisco has published nothing for this version — NOT "the device is secure" |
normalisation_failed | The version could not be parsed. Nothing was checked. |
unsupported_ostype | Not a PSIRT OS family (includes iosxr and every non-Cisco platform) |
api_error | Auth failure, rate limit, or a version Cisco has no record of |
Never report "no advisories" as "not vulnerable". none_published means Cisco has
published nothing matching that exact version string. It says nothing about
unpatched-but-unpublished issues, configuration weaknesses, or anything outside Cisco's
PSIRT process.
Never treat normalisation_failed or api_error as good news. Both mean the question
went unasked. In a fleet sweep, check the outcome_summary counts before telling anyone
the fleet is clean — devices in those two buckets were never checked at all.
This server never contacts a device. It has no transport, no credentials for your network, and no way to read a version. You supply the version:
Step 1 — read the version off the device.
# Cisco platforms: pyATS
python3 $MCP_CALL "python3 -u $PYATS_MCP_SCRIPT" run_show_command \
'{"device_name":"cat9k-1","command":"show version"}'
# Anything else, or when pyATS has no parser: the multivendor CLI driver
test cases passed, vs 7 / 16 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.