# Daily Cve Digest

> Daily scheduled agent. Polls CVE / advisory feeds (GHSA, OSV.dev, NVD) for the past 24 hours, matches against the org's declared stack in `./stack.yml`, and produces a severity-prioritized digest. Each item carries first-response SLA, remediation SLA, and a "what Dependabot will/won't catch" line — Dependabot covers direct dependency CVEs but misses ecosystem-level signals (base-image advisories, transitive depths Dependabot doesn't reach, supply-chain attack disclosures). Runs weekday mornings; outputs to vault/digests/daily/YYYY-MM-DD-daily-cve-digest.md. Use when the user asks to run the CVE or vulnerability digest, or to see what new CVEs or advisories hit the org's stack in the last day — and on its weekday-morning schedule.

- Skill: `themarmack/daily-cve-digest` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add themarmack/daily-cve-digest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/themarmack/daily-cve-digest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: themarmack (https://skillmd.com/u/themarmack)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/themarmack/daily-cve-digest

---


# daily-cve-digest

A weekday Category 2 agent. Closes the gap between "Dependabot already covers our advisories" and "actually, Dependabot misses N entire classes of signal." This skill brings the full advisory surface into view, scoped to the org's stack.

## Agent config (consumed by `scheduled-agent-runner`)

```yaml
agent_name: daily-cve-digest
cadence: daily
schedule_hint: "weekday 07:00 local; skip weekends"
source_filter:
  custom: cve-feeds
  feeds:
    - https://github.com/advisories/feed
    - https://osv.dev/list/atom
    - https://services.nvd.nist.gov/rest/json/cves/2.0
  stack_config: ./stack.yml
  max_items_per_feed: 100  # daily volume; severity filtering trims
verify_loadbearing: false  # advisory text from NVD/GHSA is authoritative
curate_findings: true       # critical/high findings stage facts for memory-curator
digest_template_overrides:
  template: cve-digest
  why_you_care_extra: |
    Per item:
    1. Direct match against critical_libraries OR ecosystem-level signal?
    2. Will Dependabot surface this automatically? (yes/no/partial)
    3. SLA for first response + remediation per severity_actions in stack.yml
```

## Matching logic

For each incoming advisory:

1. **Ecosystem check**: does the advisory's package belong to an `ecosystem` declared `in_production: true`?
2. **Critical library check**: does the advisory's package name match an entry in `critical_libraries`? If yes, **always include** regardless of severity.
3. **Ecosystem-wide signal check**: is the advisory about the ecosystem itself (not a specific package)? E.g., npm registry attack, pip-installer CVE, container-runtime CVE. **Always include**.
4. **Dependabot-covers check**: based on advisory type:
   - Direct package CVE with Dependabot-supported ecosystem → **YES, Dependabot will surface**
   - Base-image CVE → **PARTIAL** (Dependabot covers Docker but misses image-specific advisories)
   - Supply-chain attack disclosure (package takeover, typosquat campaign) → **NO** (advisory-only; no automated patch)
   - Transitive-depth-beyond-Dependabot-reach → **NO**

## Output structure

```markdown
# Daily CVE Digest — {date}

## At a glance
- {N critical, M high, K medium} matching items
- {X items Dependabot will NOT auto-surface} — these are the action-required ones

## Critical (SLA: 24h response, 7d remediate)
### {CVE-ID} — {package}
- **Affected**: {package + version range}
- **Severity**: critical (CVSS {score})
- **Dependabot covers?**: {yes/no/partial}
- **Affected paths in stack**: {which services likely impacted}
- **Source**: {URL}

## High (SLA: 3 business days, 30d remediate)
### {CVE-ID} — {package}
[same shape]

## Medium (SLA: 1 week, 90d remediate)
[same shape, condensed]

## Ecosystem-wide signals (no specific package match but worth knowing)
- {one-liners}

## Cross-references to vault
- Stack-config currency: last reviewed {date}, next review {date+90d}
- Facts staged for memory-curator: {list}
- Items queued for stakeholder-update-writer: {critical items only}
```

## Composes with

Standard Phase-1 foundation. Also:
- `stack.yml` in this skill folder — the matching config.
- [[2026-06-20-dependabot-best-practices-regulated-org]] — Dependabot's coverage characteristics inform the "Dependabot covers?" line.

## Acceptance test (for step 22 done-criteria)

`stack.yml` exists with declared ecosystems, critical_libraries, and severity_actions. SKILL.md describes the matching logic + Dependabot-covers categorization clearly. Live first-run exercise deferred to first weekday-AM cron firing.