How do I install the Cwe Kb skill?

Run npx skillmds@latest add zedarvates/cwe-kb in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cwe Kb safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cwe Kb?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cwe Kb free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cwe Kb?

zedarvates (@zedarvates) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cwe Kb by zedarvates — Agent Skill

Name: Cwe Kb
Author: zedarvates

Cwe Kb

Local CWE knowledge base (RAG) to enrich and de-noise security findings — match a finding (or any text) to the relevant weakness by exact id or local-embedding similarity, and attach the weakness name, description, and concrete mitigation. Deterministic, offline, 0 cloud tokens. Use to explain a CWE, find the likely weakness for a code snippet, or enrich taint/security findings with "why + how to fix".

zedarvates 47a5ca6 6 files · 18.3 KB Updated Sep 17, 2026

File contents

cwe_kb — local CWE knowledge base (RAG)

The DeepAudit idea, local-first: a small CWE catalog on disk + local-embedding retrieval, so every security finding comes with why it matters and how to fix it — 0 cloud tokens.

python -m skills.cwe_kb.cli lookup CWE-78
python -m skills.cwe_kb.cli match "user input concatenated into a SQL query"
python -m skills.cwe_kb.cli enrich .        # taint scan + CWE context per finding

lookup(cwe_id) — exact catalog entry (id/name/description/mitigation/common).
match(text, top_k) — rank CWE entries by local embedding similarity ([[ingest]] embedding — real /v1/embeddings endpoint if available, deterministic hash otherwise — + [[vector_protocol]] cosine).
explain(cwe_id, text) — exact by id, else best embedding matches.
enrich(findings) — attach cwe_info (name, description, mitigation) to each taint/security finding: by the analyzer's CWE tag when present, else by matching the finding's message.

The catalog (catalog.json) is a curated subset: the CWEs the [[fallow_like]] taint analyzer emits (78/89/94/502/918) plus common web/Top-25 weaknesses. Wired into the security_scan MCP tool (findings come back enriched) and exposed as cwe_explain. Completes the RepoAudit/DeepAudit-inspired security track: taint finds the flow, the KB explains and prioritises it.

Frequently asked questions