Host Cve Validator

What it does

When your agent uses it

• Tasks that involve Vulnerability scanning
• Tasks that involve Excel spreadsheets

Example prompts

• “/host-cve-validator”

Requirements

• Python 3
• Pre-approved tools (allowed-tools): Bash, Read

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

1. 1stdout 汇报：--batch / --summary stdout 完整粘贴到回复。从 stdout 获取全部汇报字段，不读取 task_results.json 等中间产物。需要按维度查询时用 plan_manager.py --query 或 jq -r '.字段' 。
2. 2硬事实原样输出：current_version/target_version/final_status 等字段原样取自 JSON，不推测、不省略、不格式化。
3. 3失败如实报告：SKIPPED/REVIEW_REQUIRED 不等于"已验证"。L3 情报已验证不等于"已修复"，汇报时保留"情报已验证"字样。
4. 4脚本白名单：仅使用上述 14 个脚本。使用 patch_unresolved.py 编辑 unresolved.json，不写 ad-hoc python。
5. 5全量跑完：vulns.json 全量处理直到 next_action=run_summary。--summary 在 completed<total 时报 SUMMARY GATE BLOCKED。用户明说"提前收尾"时用 --summary --force。

What it can do on your machine

Read from SKILL.md and the folder at commit 75a5ad9. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Bash
  • Read

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 6 files in scripts/ (Python, from the files we listed), which the agent can run.

  Shell commands in SKILL.md call:

  • python3
  • jq

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Host Cve Validator loads about 1.8k tokens when it runs, and up to ~17k if it reads all its reference files. Until then it costs about 67 tokens; SKILL.md has 315 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~67

When it runs · the whole SKILL.md, loaded when a task matches

~1.8k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~17k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Bash, Read

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

Its licence (Proprietary) doesn't allow us to republish the file, so here is its outline and opening line. It has 315 words (~1,788 tokens).

name

host-cve-validator

allowed-tools

Bash, Read

version

2.0.0

triggers

主机漏扫, host CVE, CVE修复验证, 补丁验证, fix validation

disable

false

dependency.python

openpyxl>=3.1.0, requests>=2.28.0, paramiko>=3.0.0, python-docx>=0.8.11, pywinrm>=0.5.0, mcp>=1.0.0, httpx>=0.27.0, PyYAML>=6.0

Read the full SKILL.md on GitHub

Files

SKILL.md and 58 other files (scripts, references, assets) in experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator of infometa/workbuddyskills.

• SKILL.md
• LICENSE
• README.md
• assets/PLAN.template.md
• references/demo-mode.md
• references/hallucination-guards.md
• references/pipeline.md
• references/report-constraints.md
• references/run-dir-isolation.md
• references/runtime-contract.md
• references/usage-examples.md
• requirements.txt
• scripts/adopt_proposal.py
• scripts/analyze_cve.py
• scripts/apply_fix.py
• scripts/assess_target_version.py
• scripts/classify_component.py
• scripts/default_intel.py
• … and 41 more

Open the folder on GitHubat commit 75a5ad9