How do I install the Cve Zero Day Scanner skill?

Run npx skillmds@latest add ashermahonin/cve-zero-day-scanner in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cve Zero Day Scanner safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cve Zero Day Scanner?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cve Zero Day Scanner free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cve Zero Day Scanner?

ashermahonin (@ashermahonin) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cve Zero Day Scanner by ashermahonin

Name: Cve Zero Day Scanner
Author: ashermahonin

Cve Zero Day Scanner

Check project dependencies, base images, operating-system packages, infrastructure providers, plugins, and agent tools against current vulnerability and active-exploitation sources. Use before release, after dependency changes, during incident review, and on a schedule for long-lived services. Record source, timestamp, reachability, exploitability, mitigation, owner, and release impact.

ashermahonin Updated Sep 21, 2026

File contents

CVE / Zero-Day Scanner

Purpose

Move from "we updated deps last quarter" to "as of today, these CVEs apply to this build, this one is on the KEV list, here is the patch plan and the owner". Treat unknown-unknowns by checking active exploitation feeds, not only static CVSS.

Scope and evidence

Read references/cve-workflow.md.
Pull the dependency graph: language lock files, container base images, OS packages, runtime versions, infra provider versions, MCP servers, plugins, model versions.
Pull the platform matrix from platform-detector and the OWASP status from security-owasp-web/-llm/-agentic.
Use Context7 MCP to verify current source documentation and query formats for CISA KEV, NVD, GitHub Security Advisories, ecosystem advisories, distro trackers, and vendor PSIRTs. Then query the live feeds/APIs/tools directly and record source URL, timestamp, parameters, result IDs, and raw evidence path.

Assessment

Build the asset inventory: every dependency, image, OS package, infra provider, plugin, and model with its pinned version.
Query advisory sources for each asset; collect candidate CVEs.
For each candidate CVE, compute: exposure path (is the vulnerable code path reachable?), severity (CVSS), exploitability (KEV listing, public PoC, exploit kit), blast radius, fix availability.
Bucket findings: Critical-now (KEV + reachable), Critical-latent (KEV but not reachable), High (CVSS ≥ 7 + reachable), Medium, Low.
Cross-check supply chain: signed artifacts, SLSA level, dependency confusion risk, typo-squat candidates near recent installs.
Produce patch plan: per finding, action (upgrade, pin, replace, mitigate-in-config, accept-risk-with-expiry), owner, ETA.
Issue release-gate verdict: Go / Conditional / Hold.

Safety rules

Use Context7 MCP every run for source/API documentation, but never treat Context7 output as the vulnerability feed itself.
Keep a decision trace: source feeds queried, query date/time, query parameters, response evidence, false-positive notes, accepted-risk register with expiry.
Refuse to mark a CVE Resolved without naming the artifact hash or version that contains the fix.
Escalate any KEV-listed vulnerability before any cosmetic work; KEV blocks release.

Security record

Asset inventory with pinned versions
Vulnerability register with severity, exploitability, exposure path, fix availability
KEV-listed exposures (always called out separately)
Patch plan with owners and ETAs
Accepted-risk register with named approver and expiry
Release-gate verdict

Release criteria

No KEV-listed finding accepted without a written exception by a named approver and a near-term expiry.
No "scan passed" without naming the live feeds/APIs/tools, query date/time, query parameters, response evidence, and lock file hashes scanned.
No vulnerable transitive dependency hidden behind "we only use a subset" without proving the subset.
No release gate without re-running after the patch.

Handoff

Hand off to infrastructure-as-code, container-platforms, service-implementation, or cicd-automation per finding. Re-run after the patch and update the register.

References

references/cve-workflow.md: feeds, query patterns, prioritization, and patch plan template.

---name: cve-zero-day-scannerdescription: Check project dependencies, base images, operating-system packages, infrastructure providers, plugins, and agent tools against current vulnerability and active-exploitation sources. Use before release, after dependency changes, during incident review, and on a schedule for long-lived services. Record source, timestamp, reachability, exploitability, mitigation, owner, and release impact.---# CVE / Zero-Day Scanner## PurposeMove from "we updated deps last quarter" to "as of today, these CVEs apply to this build, this one is on the KEV list, here is the patch plan and the owner". Treat unknown-unknowns by checking active exploitation feeds, not only static CVSS.## Scope and evidence1. Read `references/cve-workflow.md`.2. Pull the dependency graph: language lock files, container base images, OS packages, runtime versions, infra provider versions, MCP servers, plugins, model versions.3. Pull the platform matrix from `platform-detector` and the OWASP status from `security-owasp-web`/`-llm`/`-agentic`.4. Use Context7 MCP to verify current source documentation and query formats for CISA KEV, NVD, GitHub Security Advisories, ecosystem advisories, distro trackers, and vendor PSIRTs. Then query the live feeds/APIs/tools directly and record source URL, timestamp, parameters, result IDs, and raw evidence path.## Assessment1. Build the asset inventory: every dependency, image, OS package, infra provider, plugin, and model with its pinned version.2. Query advisory sources for each asset; collect candidate CVEs.3. For each candidate CVE, compute: exposure path (is the vulnerable code path reachable?), severity (CVSS), exploitability (KEV listing, public PoC, exploit kit), blast radius, fix availability.4. Bucket findings: Critical-now (KEV + reachable), Critical-latent (KEV but not reachable), High (CVSS ≥ 7 + reachable), Medium, Low.5. Cross-check supply chain: signed artifacts, SLSA level, dependency confusion risk, typo-squat candidates near recent installs.6. Produce patch plan: per finding, action (upgrade, pin, replace, mitigate-in-config, accept-risk-with-expiry), owner, ETA.7. Issue release-gate verdict: Go / Conditional / Hold.## Safety rules- Use Context7 MCP every run for source/API documentation, but never treat Context7 output as the vulnerability feed itself.- Keep a decision trace: source feeds queried, query date/time, query parameters, response evidence, false-positive notes, accepted-risk register with expiry.- Refuse to mark a CVE Resolved without naming the artifact hash or version that contains the fix.- Escalate any KEV-listed vulnerability before any cosmetic work; KEV blocks release.## Security record- Asset inventory with pinned versions- Vulnerability register with severity, exploitability, exposure path, fix availability- KEV-listed exposures (always called out separately)- Patch plan with owners and ETAs- Accepted-risk register with named approver and expiry- Release-gate verdict## Release criteria- No KEV-listed finding accepted without a written exception by a named approver and a near-term expiry.- No "scan passed" without naming the live feeds/APIs/tools, query date/time, query parameters, response evidence, and lock file hashes scanned.- No vulnerable transitive dependency hidden behind "we only use a subset" without proving the subset.- No release gate without re-running after the patch.## HandoffHand off to `infrastructure-as-code`, `container-platforms`, `service-implementation`, or `cicd-automation` per finding. Re-run after the patch and update the register.## References- `references/cve-workflow.md`: feeds, query patterns, prioritization, and patch plan template.

Frequently asked questions