Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →notque/cve-source-check
Audit CVE/vulnerability source coverage for a technology stack. Maps each component (container, library, base image, runtime) to authoritative CVE feeds, flags gaps, and produces audit-ready reports. Generic: works for any service or stack.
Passed 18 of 22 test cases with the skill, and 5 of 22 without it.
and 19 more in the full report
15 fixed6 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
One of 15 test cases the skill fixed. Same model, same prompt, with and without the skill.
We ran the audit with HTTP URL verification enabled. All components mapped successfully, but one authoritative feed returned an HTTP 500 error. What exit code will be produced?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies that exit code 2 is returned when source URLs fail reachability checks during `--check-urls`. | Missed | Passed |
The instructions your model reads when the skill loads.
Audit CVE/vulnerability source coverage for a technology stack. Maps components to authoritative CVE feeds via a versioned registry, flags gaps, and produces audit-ready reports (JSON + Markdown).
In scope: component-to-feed mapping, coverage/gap reporting, optional URL reachability checks. Out of scope: running scanners (Trivy/Snyk), fetching CVE content, private vuln databases.
# Inline, offline
python3 scripts/check-cve-sources.py \
--inline "[email protected],[email protected],postgres@16,redis@7,[email protected]" \
--service my-service
# Inventory + monitored feeds + link verification
python3 scripts/check-cve-sources.py \
--inventory examples/inventory.example.json \
--current-sources examples/current-sources.example.txt \
--service my-service --check-urls
| Flag | Purpose |
|---|---|
--inventory <file> | JSON: [{name, version?, type?}, ...] or {components: [...]}. |
--inline "name@ver,..." | Comma-separated list. Mutually exclusive with --inventory. |
--current-sources <file> | One URL per line. # comments and blank lines skipped. |
--service <name> | Name for report header and filenames. |
--check-urls | HEAD-check every source URL (5s timeout, graceful degradation). |
--registry <path> | Override default tech-source-registry.json. |
--out-dir <path> | Output directory (default: cwd). |
JSON only. YAML not supported (no stdlib parser).
test cases passed, vs 5 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.