# Find Cwe

> Find the right CWE ID for a vulnerability. Use when filing a CVE and the CWE is unknown or needs verification.

- Skill: `aibot88/find-cwe` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/find-cwe`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/find-cwe/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/find-cwe

---


# CWE Finder

Find the most appropriate CWE ID for the vulnerability and return the entry ready to paste into the CVE record.

## If a CWE ID is already known — verify it

Use the WebFetch tool to look up the entry:
```
https://cwe-api.mitre.org/api/v1/cwe/weakness/<ID>
```

Confirm the name and description match the vulnerability. If not, search for a better fit.

## If searching by keyword — use web search

Use the WebSearch tool to search for the vulnerability type — e.g. `site:cwe.mitre.org path traversal`, `site:cwe.mitre.org resource exhaustion`. Look for the most specific CWE that accurately describes the root cause, not just the impact.

Prefer **Base** level CWEs over **Class** (too broad) or **Variant** (too specific) when in doubt.

## Output

Return the snippet ready to paste into `problemTypes`:

```json
{
  "descriptions": [
    {
      "cweId": "CWE-<ID>",
      "description": "CWE-<ID> <Name>",
      "lang": "en",
      "type": "CWE"
    }
  ]
}
```

Usually one CWE. Multiple are acceptable when the vulnerability genuinely has distinct root causes, but this is the exception not the rule.