doezer - If the user asked about the full release history, run
node scripts/cve-report.mjs(no args) — it walks every consecutivev*tag boundary plus the unreleased range from the latest tag toHEAD, diffing resolvedpackage-lock.jsonversions (direct and transitive) and checking OSV.dev for CVEs fixed by each bump. - If the user asked about a specific version or range, run
node scripts/cve-report.mjs <fromTag> <toTag>for just that boundary instead. List tags first withgit tag --list 'v*' --sort=v:refnameif the exact tag names aren't already known. - Present the script's output to the user as-is — it is already grouped per version boundary, then by scope (Production/Development dependencies) and severity (CRITICAL → HIGH → MODERATE → LOW → UNKNOWN) within each. Do not add, infer, or embellish CVE claims beyond what the script printed; OSV.dev is the source of truth here.
- If the user wants the report saved, write it to
docs/CVE-REPORT.md(or a path they specify). Do not auto-editdocs/CHANGELOG.md— CVE attribution needs human review before it becomes part of published release notes. - If the script errors (network failure reaching OSV.dev, a ref missing
package-lock.json, etc.), report the specific error to the user rather than retrying blindly or guessing at results.
Cve Report
Report which CVEs were fixed in each Questarr release by diffing package-lock.json across version tags and checking OSV.dev
Cve Report by doezer · 3cd1cd7
npx skillmds@latest add doezer/cve-report File contents
---name: cve-reportdescription: Report which CVEs were fixed in each Questarr release by diffing package-lock.json across version tags and checking OSV.dev---1. If the user asked about the full release history, run `node scripts/cve-report.mjs` (no args) — it walks every consecutive `v*` tag boundary plus the unreleased range from the latest tag to `HEAD`, diffing resolved `package-lock.json` versions (direct and transitive) and checking OSV.dev for CVEs fixed by each bump.2. If the user asked about a specific version or range, run `node scripts/cve-report.mjs <fromTag> <toTag>` for just that boundary instead. List tags first with `git tag --list 'v*' --sort=v:refname` if the exact tag names aren't already known.3. Present the script's output to the user as-is — it is already grouped per version boundary, then by scope (Production/Development dependencies) and severity (CRITICAL → HIGH → MODERATE → LOW → UNKNOWN) within each. Do not add, infer, or embellish CVE claims beyond what the script printed; OSV.dev is the source of truth here.4. If the user wants the report saved, write it to `docs/CVE-REPORT.md` (or a path they specify). Do not auto-edit `docs/CHANGELOG.md` — CVE attribution needs human review before it becomes part of published release notes.5. If the script errors (network failure reaching OSV.dev, a ref missing `package-lock.json`, etc.), report the specific error to the user rather than retrying blindly or guessing at results.
doezer/questarr/tree/main/.claude/skills/cve-report commit 3cd1cd7e84
Frequently asked questions
Run npx skillmds@latest add doezer/cve-report in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Report which CVEs were fixed in each Questarr release by diffing package-lock.json across version tags and checking OSV.dev It is listed under Docs & Writing on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
doezer (@doezer) published this skill. Their other Agent Skills are listed on their SkillMD profile.