How do I install the Cve Risk Score skill?

Run npx skillmds@latest add transilienceai/cve-risk-score in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cve Risk Score safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cve Risk Score?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cve Risk Score free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cve Risk Score?

transilienceai (@transilienceai) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cve Risk Score by transilienceai — Agent Skill

Name: Cve Risk Score
Rating: 4.2 (5 reviews)
Author: transilienceai

File contents

CVE Risk Score

Fetch and display CVE risk scores from the National Vulnerability Database (NVD) whenever a CVE ID appears in conversation.

Trigger

This skill MUST be invoked automatically whenever a CVE ID (pattern CVE-YYYY-NNNNN) is mentioned by the user or discovered during research/scanning. Do not wait for explicit invocation.

Workflow

Extract CVE IDs from the user's message or tool output (regex: CVE-\d{4}-\d{4,})

Run the lookup script:

python3 tools/nvd-lookup.py CVE-XXXX-XXXXX [CVE-YYYY-YYYYY ...]

Present the results in a concise table format:

CVE ID Score Severity CWE Description

CVE-XXXX-XXXXX 9.8 CRITICAL CWE-79 ...
Continue with the user's original task — the score lookup is supplementary context, not a blocking step.

CVE ID	Score	Severity	CWE	Description
CVE-XXXX-XXXXX	9.8	CRITICAL	CWE-79	...

Output Format

When presenting CVE risk scores inline, use this compact format:

CVE-2024-12345: 9.8 CRITICAL (CWE-79) — Remote code execution via ...

For multiple CVEs, use a markdown table.

Rules

Always invoke — every CVE ID mentioned triggers a lookup. No exceptions.
Non-blocking — fetch scores in parallel with other work when possible.
Accurate data only — display exactly what NVD returns. Never estimate or fabricate scores.
Graceful degradation — if NVD is unreachable or the CVE has no score yet, say so explicitly (e.g., "Not yet scored by NVD").
Rate limiting — the script handles rate limits internally. For bulk lookups (5+), warn that NVD throttles unauthenticated requests.
API key — if NVD_API_KEY is set in .env, the script uses it for higher rate limits.

Integration

This skill complements other skills:

cve-poc-generator: After seeing the risk score, the user may want a full PoC and report
reconnaissance / source-code-scanning: When these skills discover CVEs in dependencies, auto-lookup their scores
coordination: CVE scores inform priority and severity classification in findings

--- name: cve-risk-score description: Retrieve CVE risk scores from NVD. Auto-invoked whenever a CVE ID is mentioned to display CVSS score, severity, CWE, and description. --- # CVE Risk Score Fetch and display CVE risk scores from the National Vulnerability Database (NVD) whenever a CVE ID appears in conversation. ## Trigger This skill MUST be invoked automatically whenever a CVE ID (pattern `CVE-YYYY-NNNNN`) is mentioned by the user or discovered during research/scanning. Do not wait for explicit invocation. ## Workflow 1. **Extract CVE IDs** from the user's message or tool output (regex: `CVE-\d{4}-\d{4,}`) 2. **Run the lookup script**: ```bash python3 tools/nvd-lookup.py CVE-XXXX-XXXXX [CVE-YYYY-YYYYY ...] ``` 3. **Present the results** in a concise table format: | CVE ID | Score | Severity | CWE | Description | |--------|-------|----------|-----|-------------| | CVE-XXXX-XXXXX | 9.8 | CRITICAL | CWE-79 | ... | 4. **Continue with the user's original task** — the score lookup is supplementary context, not a blocking step. ## Output Format When presenting CVE risk scores inline, use this compact format: ``` CVE-2024-12345: 9.8 CRITICAL (CWE-79) — Remote code execution via ... ``` For multiple CVEs, use a markdown table. ## Rules 1. **Always invoke** — every CVE ID mentioned triggers a lookup. No exceptions. 2. **Non-blocking** — fetch scores in parallel with other work when possible. 3. **Accurate data only** — display exactly what NVD returns. Never estimate or fabricate scores. 4. **Graceful degradation** — if NVD is unreachable or the CVE has no score yet, say so explicitly (e.g., "Not yet scored by NVD"). 5. **Rate limiting** — the script handles rate limits internally. For bulk lookups (5+), warn that NVD throttles unauthenticated requests. 6. **API key** — if `NVD_API_KEY` is set in `.env`, the script uses it for higher rate limits. ## Integration This skill complements other skills: - **cve-poc-generator**: After seeing the risk score, the user may want a full PoC and report - **reconnaissance / source-code-scanning**: When these skills discover CVEs in dependencies, auto-lookup their scores - **coordination**: CVE scores inform priority and severity classification in findings

Frequently asked questions

Cve Risk Score