Security Audit
Aedelon/claude-code-blueprint
Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults.
漏扫报告分析 Skill。输入主流厂商漏扫报告（绿盟/深信服/悬镜/明鉴/等保/奇安信/启明/华云安/长亭/Nessus/Trivy/Grype/Snyk/OpenVAS 等 Excel/HTML/JSON/XML/.nessus 格式），自动提取漏洞并去重，可选对接知识库 Provider（修复历史）和威胁情报 Provider（CVE 情报），生成 7…
Install Vul Analyse
$ npx skills add infometa/workbuddyskills --skill vul-analyse -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install infometa/workbuddyskills vul-analyse --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse .claude/skills/vul-analyse && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "vul-analyse" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse into .claude/skills/vul-analyse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vul-analyse", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyseType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add infometa/workbuddyskills --skill vul-analyse -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install infometa/workbuddyskills vul-analyse --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse .agents/skills/vul-analyse && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "vul-analyse" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse into .agents/skills/vul-analyse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vul-analyse", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add infometa/workbuddyskills --skill vul-analyse -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install infometa/workbuddyskills vul-analyse --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse .cursor/skills/vul-analyse && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "vul-analyse" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse into .cursor/skills/vul-analyse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vul-analyse", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/infometa/workbuddyskills.git --path experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add infometa/workbuddyskills --skill vul-analyse -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install infometa/workbuddyskills vul-analyse --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse .gemini/skills/vul-analyse && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "vul-analyse" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse into .gemini/skills/vul-analyse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vul-analyse", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install infometa/workbuddyskills vul-analyseInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add infometa/workbuddyskills --skill vul-analyse -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .github/skills && cp -r skills-src/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse .github/skills/vul-analyse && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "vul-analyse" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse into .github/skills/vul-analyse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vul-analyse", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add infometa/workbuddyskills --skill vul-analyse -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install infometa/workbuddyskills vul-analyse --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse .opencode/skills/vul-analyse && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "vul-analyse" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse into .opencode/skills/vul-analyse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vul-analyse", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
vul-analyse- GitHub stars
- 346
- Token cost
- ~3.9k tokens
- SKILL.md length
- 788 words
- Files
- 29 (incl. scripts, references, assets)
- Skills in repo
- 218
- Repo updated
- First seen
- Licence
- None found
At a glance
漏扫报告分析 Skill。输入主流厂商漏扫报告（绿盟/深信服/悬镜/明鉴/等保/奇安信/启明/华云安/长亭/Nessus/Trivy/Grype/Snyk/OpenVAS 等 Excel/HTML/JSON/XML/.nessus 格式），自动提取漏洞并去重，可选对接知识库 Provider（修复历史）和威胁情报 Provider（CVE 情报），生成 7…
- Works in 5 steps: 文件命名规范（强制） → 排序与聚合（自动） → 字段渲染（自动） → …
- Tasks that involve Vulnerability scanning
- SKILL.md covers 🧠 执行前思考（收到报告后，先推理再行动）, 🚨 执行契约（11 条铁律）, 🔒 输出一致性约定（v1.1 发布版强约束） and ⚠️ 不确定时的退路（严格执行，不得擅自降级）, plus 8 more sections
- Runs Python scripts from its folder; calls python3; needs NVD_API_KEY
What it does
Vul Analyse is an agent skill from infometa/workbuddyskills. 漏扫报告分析 Skill。输入主流厂商漏扫报告（绿盟/深信服/悬镜/明鉴/等保/奇安信/启明/华云安/长亭/Nessus/Trivy/Grype/Snyk/OpenVAS 等 Excel/HTML/JSON/XML/.nessus 格式），自动提取漏洞并去重，可选对接知识库 Provider（修复历史）和威胁情报 Provider（CVE 情报），生成 7 章节结构化分析报告。当用户提供漏扫报告并要求漏洞分析或安全评估时触发。
Its SKILL.md is about 3.9k tokens, which your agent loads only when the skill is triggered. The skill folder holds 31 other files, including scripts, reference files and assets (for example `CHANGELOG.md`, `assets/PLAN.template.md` and `assets/report_template.md`).
It sits in Security, covering Vulnerability scanning and Excel spreadsheets. It works with Snyk, Trivy, Microsoft Excel and Python. The repository describes itself as: WorkBuddy skills / connectors / experts archive for offline study.
When your agent uses it
- Tasks that involve Vulnerability scanning
- Tasks that involve Excel spreadsheets
Example prompts
- “/vul-analyse”
Requirements
- Python 3
- A credential in NVD_API_KEY
Workflow steps
5 steps, taken from the step headings in SKILL.md.
- 文件命名规范（强制）
- 排序与聚合（自动）
- 字段渲染（自动）
- 三元组去重（自动）
- 幂等性回归（发布前必跑）
What it can do on your machine
Read from SKILL.md and the folder at commit 692b3eb. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 5 files in scripts/ (Python, from the files we listed), which the agent can run.
Shell commands in SKILL.md call:
python3
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
NVD_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Vul Analyse loads about 3.9k tokens when it runs, and up to ~16k if it reads all its reference files. Until then it costs about 57 tokens; SKILL.md has 788 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 788 words (~3,923 tokens).
- name
- vul-analyse
- version
- 1.1.0
- triggers
- 漏洞扫描, 漏扫报告, CVSS, 漏洞清单, 漏洞评估
- dependency.python
- pandas>=2.0,<3.0, openpyxl>=3.1,<4.0, PyYAML>=6.0,<7.0, beautifulsoup4>=4.12,<5.0, httpx>=0.27,<1.0, jsonpath-ng>=1.6,<2.0
Files
SKILL.md and 28 other files (scripts, references, assets) in experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse of infometa/workbuddyskills.
- SKILL.md
- CHANGELOG.md
- assets/PLAN.template.md
- assets/report_template.md
- providers.yaml
- providers.yaml.example
- references/env-config.md
- references/mcp_guide.md
- references/parser-development.md
- references/pipeline.md
- references/runtime-contract.md
- references/scanner-formats.md
- references/standard_fields.md
- scripts/cfg.yaml
- scripts/dedupe_cves.py
- scripts/default_intel.py
- scripts/extract_vulns.py
- scripts/parser_registry.py
- … and 11 more
Open the folder on GitHubat commit 692b3eb
Compare with similar skills
Vul Analyse next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Vul Analyse this skillinfometa/workbuddyskills | 346 | — | ~3.9k | Automated safety check: Pass | None | |
| Security AuditAedelon/claude-code-blueprint | 120 | — | ~1.6k | Automated safety check: Notes | Custom licence | |
| Sca TrivyAgentSecOps/SecOpsAgentKit | 220 | 2 repos | ~3.7k | Automated safety check: Pass | Custom licence | |
| Fix Security Issuehardisgroupcom/sfdx-hardis | 402 | — | ~1.3k | Automated safety check: Notes | AGPL-3.0 | |
| Vulnerability Scanningsecondsky/claude-skills | 227 | — | ~799 | Automated safety check: Pass | MIT | |
| Cve Analysisrevfactory/harness-100 | 1.3k | — | ~853 | Automated safety check: Pass | Apache-2.0 |
Similar skills
Sca Trivy
AgentSecOps/SecOpsAgentKit
Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…
Fix Security Issue
hardisgroupcom/sfdx-hardis
Handle CVE/vulnerability reports from security linters (trivy, osv-scanner, etc.).
Vulnerability Scanning
secondsky/claude-skills
Automated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit.
Cve Analysis
revfactory/harness-100
CVE(Common Vulnerabilities and Exposures) 분석 방법론, 의존성 취약점 스캔 도구 활용, CVSS 점수 해석, 취약점 우선순위 결정 가이드.
XLSX
rvdbreemen/OTGW-firmware
Use this skill any time a spreadsheet file is the primary input or output.
More from infometa/workbuddyskills
All 218 skills in this repoCampus Event Playbook
infometa/workbuddyskills
This skill should be used when planning, coordinating, running, or reviewing student-led campus events, including club recruitment, freshman mixers, welcome activities, small talks, competitions…
Teachany
infometa/workbuddyskills
K-12 interactive courseware creation. An agent skill from infometa/workbuddyskills.
Weight Management HTML
infometa/workbuddyskills
A skill your agent uses when the adult weight-management MCP needs to be installed/set up in WorkBuddy (connector) or its result must be rendered as a standalone Chinese HTML plan.
Agent Browser
infometa/workbuddyskills
A skill your agent uses when the user needs browser automation, including opening web pages, taking screenshots, extracting page content, clicking elements, filling forms, or testing web flows.
AI Research Radar
infometa/workbuddyskills
定时任务：每日研究简报。漏掉重要论文和行业报告？每天帮你盯着，关键信息一条不漏 This skill should be used when the user asks about 定时任务：每日研究简报.
Check Deck
infometa/workbuddyskills
Investment banking presentation quality checker. An agent skill from infometa/workbuddyskills.
Related
Works with
Categories
Questions about Vul Analyse
What does Vul Analyse do?
漏扫报告分析 Skill。输入主流厂商漏扫报告（绿盟/深信服/悬镜/明鉴/等保/奇安信/启明/华云安/长亭/Nessus/Trivy/Grype/Snyk/OpenVAS 等 Excel/HTML/JSON/XML/.nessus 格式），自动提取漏洞并去重，可选对接知识库 Provider（修复历史）和威胁情报 Provider（CVE 情报），生成 7…. Vul Analyse is an agent skill from infometa/workbuddyskills.
When should I use Vul Analyse?
Vul Analyse fits situations like: tasks that involve Vulnerability scanning; tasks that involve Excel spreadsheets.
How do I install Vul Analyse in Claude Code?
Run `npx skills add infometa/workbuddyskills --skill vul-analyse -a claude-code`. Or copy the skill folder (experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse in infometa/workbuddyskills) into .claude/skills/vul-analyse in your project. Claude Code loads it when a task matches its description.
How do I install Vul Analyse in Codex?
Run `npx skills add infometa/workbuddyskills --skill vul-analyse -a codex`. Or copy the skill folder (experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse in infometa/workbuddyskills) into .agents/skills/vul-analyse in your project. Codex loads it when a task matches its description.
Can I use Vul Analyse in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add infometa/workbuddyskills --skill vul-analyse -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/vul-analyse, .gemini/skills/vul-analyse, .github/skills/vul-analyse and .opencode/skills/vul-analyse in your project.
What does Vul Analyse need to run?
Going by SKILL.md and its folder, Vul Analyse needs Python for the scripts in its folder, the command-line tools its instructions call (python3) and credentials named NVD_API_KEY. Our summary lists: Python 3; A credential in NVD_API_KEY.
Does Vul Analyse access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Vul Analyse safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Vul Analyse use?
No licence was found for Vul Analyse or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does Vul Analyse use?
About 3.9k tokens (SKILL.md is roughly 16k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 12k tokens, read only when the agent opens those files.
What are the alternatives to Vul Analyse?
Skills that share tags, products or a category with Vul Analyse: Security Audit (Aedelon/claude-code-blueprint, 120 stars), Sca Trivy (AgentSecOps/SecOpsAgentKit, 220 stars), Fix Security Issue (hardisgroupcom/sfdx-hardis, 402 stars) and Vulnerability Scanning (secondsky/claude-skills, 227 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Vul Analyse?
infometa (a GitHub user) maintains it in infometa/workbuddyskills, which has 346 GitHub stars. The repository holds 218 skills in this directory. The repository was last updated on October 8, 2026.
Source: infometa/workbuddyskills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.