# Threat Advisory

> Generate a personalized threat advisory based on your tech stack — what CVEs, breaches, and supply chain attacks matter to YOU. Use when this capability is needed.

- Skill: `tomevault-io/threat-advisory` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/threat-advisory`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/threat-advisory/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/threat-advisory

---


# Threat Advisory

Generate a personalized threat intelligence digest filtered to YOUR tech stack.

## What to do

Read `shasta.config.json` for `python_cmd`. Use that for all commands (shown as `<PYTHON_CMD>`).

1. **Generate the advisory:**
   ```bash
   <PYTHON_CMD> -c "
   import json
   from shasta.config import get_aws_client
   from shasta.sbom.discovery import discover_sbom
   from shasta.threat_intel.advisory import generate_daily_advisory, save_advisory_report

   client = get_aws_client()
   client.validate_credentials()
   print('Building tech stack profile...')
   sbom = discover_sbom(client)
   print('Querying threat feeds...')
   report = generate_daily_advisory(sbom, lookback_days=7)
   path = save_advisory_report(report)
   print(json.dumps({
       'report_path': str(path),
       'tech_stack': report.tech_stack_summary,
       'total_advisories': report.total_advisories,
       'critical': report.critical_count,
       'high': report.high_count,
       'advisories': [{
           'id': a.id, 'title': a.title, 'severity': a.severity,
           'affected': a.affected_component, 'action': a.action_required,
           'is_kev': a.is_kev, 'is_supply_chain': a.is_supply_chain,
       } for a in report.advisories]
   }, indent=2))
   "
   ```

2. **Present as a personalized briefing:** KEV items first (actively exploited), supply chain next, then CVEs. For each: what it is, what's affected in THEIR env, what to do.

---
> Source: [transilienceai/shasta](https://github.com/transilienceai/shasta) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-19 -->