How do I install the Rhdh Overlay Cve Export skill?

Run npx skillmds@latest add redhat-developer/rhdh-overlay-cve-export in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Rhdh Overlay Cve Export safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Rhdh Overlay Cve Export?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Rhdh Overlay Cve Export free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Rhdh Overlay Cve Export?

redhat-developer (@redhat-developer) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Rhdh Overlay Cve Export by redhat-developer

Name: Rhdh Overlay Cve Export
Author: redhat-developer

Rhdh Overlay Cve Export

Builds the "RHDH CVE Management - <version>-plugins.csv" export by walking `rhdh-plugin-export-overlays` git history on a release branch since a revision, scoped to generally-available plugin workspaces, then enriching each CVE from Jira RHIDP, RHDHBUGS, and RHDHPLAN. Use for "generate the plugin overlay CVE CSV for 1.10.3", "what CVEs were fixed in plugins since 1.10.2", or "rebuild the plugin CVE list with the ProdSec CVSS scores".

redhat-developer 80eebed 7 files · 67.4 KB Updated Sep 17, 2026

File contents

Plugin overlay CVE export

Turn overlays git history into the CSV that RHDH CVE Management expects: one row per CVE and affected plugin package, scoped to generally-available workspaces.

This is a package-inventory job, not release reporting. It answers "which plugin containers carry which CVE fix", from git — not "how is the release doing", which is /rhdh-release-status.

Route

Load workflows/overlay-cve-export.md. It covers the extract run, Jira enrichment, and the flag set.

Two references belong to this workflow alone and are read on demand:

references/overlay-cve-csv-format.md — the exact header, the row rule, the Container column, and the default output path.
references/overlay-cve-sources.md — which workspaces and commits count, how CVEs and Jira keys are extracted, and how --since resolves.

Do not reimplement the parsing

scripts/compute-plugin-package-overlay-cve-list.mjs owns commit selection, CVE extraction, pairing, dedupe, and CSV shape. Run it. Reading the overlays repo by hand and assembling rows in chat produces a different answer than the export the CVE process is checked against.

The script never calls Jira. Enrichment is a separate pass: invoke /rhdh-jira-api for the issue fields, write them to a JSON file, and feed that back through --apply-enrich.

Writing rules

The extract itself only clones and reads. Writing the enrichment JSON and the final CSV creates files on the user's disk — say where they will land and get agreement before the run that writes them. Never commit the CSV into a repository, and never post it anywhere.

Completion

Complete when the CSV path is named, the row count is stated, and the --since revision the script actually resolved is reported rather than the version string that was asked for. Every CVE without a Jira issue is listed with the overlays commit URL that stands in for it. CVSS appears only where a ProdSec CVSS field supplied it — a blank CVSS column is the correct output, never a filled-in guess. Rows dropped by the --jql filter are counted, so the user can tell an empty result from a filtered one. No credential or OAuth secret appears in any output.

---name: rhdh-overlay-cve-exportdescription: Builds the "RHDH CVE Management - <version>-plugins.csv" export by walking `rhdh-plugin-export-overlays` git history on a release branch since a revision, scoped to generally-available plugin workspaces, then enriching each CVE from Jira RHIDP, RHDHBUGS, and RHDHPLAN. Use for "generate the plugin overlay CVE CSV for 1.10.3", "what CVEs were fixed in plugins since 1.10.2", or "rebuild the plugin CVE list with the ProdSec CVSS scores".---# Plugin overlay CVE exportTurn overlays git history into the CSV that RHDH CVE Management expects: one rowper CVE and affected plugin package, scoped to generally-available workspaces.This is a package-inventory job, not release reporting. It answers "which plugincontainers carry which CVE fix", from git — not "how is the release doing", whichis `/rhdh-release-status`.## RouteLoad `workflows/overlay-cve-export.md`. It covers the extract run, Jiraenrichment, and the flag set.Two references belong to this workflow alone and are read on demand:- `references/overlay-cve-csv-format.md` — the exact header, the row rule, the Container column, and the default output path.- `references/overlay-cve-sources.md` — which workspaces and commits count, how CVEs and Jira keys are extracted, and how `--since` resolves.## Do not reimplement the parsing`scripts/compute-plugin-package-overlay-cve-list.mjs` owns commit selection, CVEextraction, pairing, dedupe, and CSV shape. Run it. Reading the overlays repo byhand and assembling rows in chat produces a different answer than the export theCVE process is checked against.The script never calls Jira. Enrichment is a separate pass: invoke `/rhdh-jira-api`for the issue fields, write them to a JSON file, and feed that back through`--apply-enrich`.## Writing rulesThe extract itself only clones and reads. Writing the enrichment JSON and thefinal CSV creates files on the user's disk — say where they will land and getagreement before the run that writes them. Never commit the CSV into arepository, and never post it anywhere.## CompletionComplete when the CSV path is named, the row count is stated, and the `--since`revision the script actually resolved is reported rather than the version stringthat was asked for. Every CVE without a Jira issue is listed with the overlayscommit URL that stands in for it. CVSS appears only where a ProdSec CVSS fieldsupplied it — a blank CVSS column is the correct output, never a filled-in guess.Rows dropped by the `--jql` filter are counted, so the user can tell an emptyresult from a filtered one. No credential or OAuth secret appears in any output.

Frequently asked questions