Agent skill

Cveapi

CVE lookup via MITRE + NVD: severity, CVSS, affected products, refs

Apache-2.0Auto-check passedSecurity

Install Cveapi

skills CLI

$ npx skills add taracodlabs/aiden --skill cveapi -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden cveapi --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/cveapi .claude/skills/cveapi && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "cveapi" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/cveapi into .claude/skills/cveapi/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cveapi", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/taracodlabs/aiden/tree/main/skills/cveapi

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add taracodlabs/aiden --skill cveapi -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden cveapi --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/cveapi .agents/skills/cveapi && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "cveapi" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/cveapi into .agents/skills/cveapi/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cveapi", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add taracodlabs/aiden --skill cveapi -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden cveapi --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/cveapi .cursor/skills/cveapi && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "cveapi" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/cveapi into .cursor/skills/cveapi/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cveapi", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/taracodlabs/aiden.git --path skills/cveapi

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add taracodlabs/aiden --skill cveapi -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden cveapi --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/cveapi .gemini/skills/cveapi && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "cveapi" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/cveapi into .gemini/skills/cveapi/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cveapi", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install taracodlabs/aiden cveapi

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add taracodlabs/aiden --skill cveapi -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/cveapi .github/skills/cveapi && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "cveapi" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/cveapi into .github/skills/cveapi/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cveapi", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add taracodlabs/aiden --skill cveapi -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden cveapi --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/cveapi .opencode/skills/cveapi && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "cveapi" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/cveapi into .opencode/skills/cveapi/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cveapi", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: cveapi
GitHub stars: 849
Token cost: ~1.1k tokens
SKILL.md length: 270 words
Files: 3
Skills in repo: 63
Repo updated: Sep 13, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

CVE lookup via MITRE + NVD: severity, CVSS, affected products, refs

Tasks that involve Vulnerability scanning
SKILL.md covers When to Use, How to Use, Examples and Cautions, plus 1 more section
Runs TypeScript scripts from its folder; reaches cveawg.mitre.org and services.nvd.nist.gov; needs NVD_API_KEY

What it does

Cveapi is an agent skill from taracodlabs/aiden. CVE lookup via MITRE + NVD: severity, CVSS, affected products, refs

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `index.ts` and `skill.json`).

It sits in Security, covering Vulnerability scanning. The repository describes itself as: Aiden — an autonomous AI agent and work engine built solo. It can operate your browser, terminal, files, apps, APIs, skills and tools, remember context, recover from failures… The licence is Apache-2.0.

When your agent uses it

Tasks that involve Vulnerability scanning

Example prompts

“/cveapi”

Requirements

Node.js
A credential in NVD_API_KEY

What it can do on your machine

Read from SKILL.md and the folder at commit 3704204. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships script files (TypeScript), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
- cveawg.mitre.org
- services.nvd.nist.gov
Also links to:
- nvd.nist.gov
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
- NVD_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Cveapi loads about 1.1k tokens when it runs. Until then it costs about 19 tokens; SKILL.md has 270 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~19
When it runs · the whole SKILL.md, loaded when a task matches: ~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from taracodlabs/aiden at commit 3704204, republished under its Apache-2.0 licence (© taracodlabs). 270 words, ~1,109 tokens.

Download SKILL.mdSave it as .claude/skills/cveapi/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.

name: cveapi
description: CVE lookup via MITRE + NVD: severity, CVSS, affected products, refs
category: security
version: 1.0.0
license: Apache-2.0
origin: aiden
tags: security, cve, vulnerability, nvd, mitre, cvss, patch, incident-response, compliance

CVE API — Vulnerability Lookup

Look up any CVE (Common Vulnerabilities and Exposures) by ID to get severity, CVSS score, affected products, and reference links. Uses the MITRE CVE API (cveawg.mitre.org) with automatic fallback to the NVD (National Vulnerability Database) for richer data.

No API key required. Optionally set NVD_API_KEY for higher rate limits on the NVD endpoint.

When to Use

User asks about a specific CVE by ID (e.g. "what is CVE-2021-44228?")
Security team needs severity and CVSS score for patch prioritization
Incident response: quickly triage whether a reported CVE is critical
Compliance audit: confirm affected software versions for a given vulnerability
User asks "is this CVE critical?", "what does CVE-XXXX-XXXXX affect?"

How to Use

Look up a single CVE (MITRE CVE API)

powershell

$cveId = "CVE-2021-44228"
$url   = "https://cveawg.mitre.org/api/cve/$cveId"

$result = Invoke-RestMethod -Uri $url
$cna    = $result.containers.cna
$desc   = ($cna.descriptions | Where-Object { $_.lang -eq 'en' } | Select-Object -First 1).value
$cvss   = $cna.metrics | ForEach-Object {
    $_.PSObject.Properties | Where-Object { $_.Name -like 'cvssV3*' } |
    Select-Object -First 1 -ExpandProperty Value
} | Select-Object -First 1

Write-Host "CVE:          $($result.cveMetadata.cveId)"
Write-Host "State:        $($result.cveMetadata.state)"
Write-Host "Published:    $($result.cveMetadata.datePublished)"
Write-Host "Score:        $($cvss.baseScore) ($($cvss.baseSeverity))"
Write-Host "Description:  $desc"
Write-Host "References:   $(($cna.references | Select-Object -First 3 -ExpandProperty url) -join ', ')"

Look up via NVD (richer data, optional API key)

powershell

$cveId   = "CVE-2021-44228"
$headers = @{}
if ($env:NVD_API_KEY) { $headers['apiKey'] = $env:NVD_API_KEY }

$url    = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=$cveId"
$result = Invoke-RestMethod -Uri $url -Headers $headers
$cve    = $result.vulnerabilities[0].cve
$desc   = ($cve.descriptions | Where-Object { $_.lang -eq 'en' } | Select-Object -First 1).value
$metric = $cve.metrics.cvssMetricV31[0].cvssData

Write-Host "CVE:       $($cve.id)"
Write-Host "Published: $($cve.published)"
Write-Host "Score:     $($metric.baseScore) ($($metric.baseSeverity))"
Write-Host "Vector:    $($metric.vectorString)"
Write-Host "Desc:      $($desc.Substring(0, [Math]::Min(200, $desc.Length)))..."

Batch lookup — check multiple CVEs

powershell

$cveIds = @("CVE-2021-44228", "CVE-2023-4863", "CVE-2024-3094")

foreach ($id in $cveIds) {
    try {
        $url    = "https://cveawg.mitre.org/api/cve/$id"
        $result = Invoke-RestMethod -Uri $url
        $cna    = $result.containers.cna
        $cvss   = ($cna.metrics | Where-Object { $_.PSObject.Properties.Name -like 'cvssV3*' } |
                   Select-Object -First 1).PSObject.Properties.Value | Select-Object -First 1
        Write-Host "$id  Score: $($cvss.baseScore ?? 'N/A')  ($($cvss.baseSeverity ?? 'UNKNOWN'))"
    } catch {
        Write-Host "$id  ERROR: $($_.Exception.Message)"
    }
    Start-Sleep -Milliseconds 200   # polite rate limiting
}

Examples

"Look up CVE-2021-44228" → Returns Log4Shell details: CVSS 10.0 CRITICAL, affects Apache Log4j 2.x.

"What's the severity of CVE-2023-4863?" → Returns WebP heap buffer overflow: CVSS 8.8 HIGH, affects Chrome/libwebp.

"Get details for CVE-2024-3094" → Returns XZ Utils backdoor: CVSS 10.0 CRITICAL, supply-chain attack.

"Is CVE-2024-12345 critical?" → Looks up and reports severity tier: CRITICAL / HIGH / MEDIUM / LOW / NONE.

Cautions

MITRE CVE API has no documented rate limit — use 1–2 req/sec as a courtesy
NVD has stricter rate limiting: 5 req/30s without a key, 50 req/30s with NVD_API_KEY
Some CVEs are RESERVED (not yet disclosed) — the API returns limited data
CVSS score may be absent for very new or disputed CVEs
NVD and MITRE may have slightly different data — NVD is generally more complete

Requirements

No key required for basic use
NVD_API_KEY (optional) — free at https://nvd.nist.gov/developers/request-an-api-key

Files

SKILL.md and 2 other files in skills/cveapi of taracodlabs/aiden.

SKILL.md
index.ts
skill.json

Open the folder on GitHubat commit 3704204

Compare with similar skills

Cveapi next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Cveapi compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Cveapi this skilltaracodlabs/aiden	849	—	~1.1k	Automated safety check: Pass	Apache-2.0	24 days ago
Deepsec Documentation Guidevercel-labs/deepsec	8.1k	—	~956	Automated safety check: Pass	Apache-2.0	8 days ago
Shiro Attack CLISummerSec/ShiroAttack2	2.6k	—	~945	Automated safety check: Pass	MIT	4 mo ago
Cve Remediationrundeck/rundeck	6.3k	—	~2.9k	Automated safety check: Pass	Apache-2.0	today
Native Dependency Updatemono/SkiaSharp	5.6k	—	~4.1k	Automated safety check: Pass	MIT	today
Forensifyalexgreensh/repo-forensics	187	—	~2.5k	Automated safety check: Notes	Custom licence	10 days ago

Similar skills

Deepsec Documentation Guide
vercel-labs/deepsec
Official
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
8.1k GitHub stars~956 tokensUpdated 8 days ago
SecurityAuto-check passed
Shiro Attack CLI
SummerSec/ShiroAttack2
当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…
2.6k GitHub stars~945 tokensUpdated 4 mo ago
SecurityAuto-check passed
Cve Remediation
rundeck/rundeck
Verify if a CVE affects the project and remediate it. An agent skill from rundeck/rundeck.
6.3k GitHub stars~2.9k tokensUpdated today
SecurityAuto-check passed
Native Dependency Update
mono/SkiaSharp
Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.
5.6k GitHub stars~4.1k tokensUpdated today
SecurityAuto-check passed
Forensify
alexgreensh/repo-forensics
Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.
187 GitHub stars~2.5k tokensUpdated 10 days ago
SecurityAuto-check: notes
Write Cve Rule
evdenis/cvehound
Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.
138 GitHub stars~2.5k tokensUpdated 5 days ago
SecurityAuto-check passed

Questions about Cveapi

What does Cveapi do?

CVE lookup via MITRE + NVD: severity, CVSS, affected products, refs. Cveapi is an agent skill from taracodlabs/aiden.

When should I use Cveapi?

Cveapi fits situations like: tasks that involve Vulnerability scanning.

How do I install Cveapi in Claude Code?

Run `npx skills add taracodlabs/aiden --skill cveapi -a claude-code`. Or copy the skill folder (skills/cveapi in taracodlabs/aiden) into .claude/skills/cveapi in your project. Claude Code loads it when a task matches its description.

How do I install Cveapi in Codex?

Run `npx skills add taracodlabs/aiden --skill cveapi -a codex`. Or copy the skill folder (skills/cveapi in taracodlabs/aiden) into .agents/skills/cveapi in your project. Codex loads it when a task matches its description.

Can I use Cveapi in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add taracodlabs/aiden --skill cveapi -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cveapi, .gemini/skills/cveapi, .github/skills/cveapi and .opencode/skills/cveapi in your project.

What does Cveapi need to run?

Going by SKILL.md and its folder, Cveapi needs TypeScript for the scripts in its folder and credentials named NVD_API_KEY. Our summary lists: Node.js; A credential in NVD_API_KEY.

Does Cveapi access the network?

SKILL.md names 3 domains. In commands or code: cveawg.mitre.org and services.nvd.nist.gov; the agent is likely to contact these when it follows the instructions. As links in the text: nvd.nist.gov. This is read from the text; nothing was executed.

Is Cveapi safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Cveapi use?

Cveapi is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Cveapi use?

About 1.1k tokens (SKILL.md is roughly 4.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Cveapi?

Skills that share tags, products or a category with Cveapi: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Shiro Attack CLI (SummerSec/ShiroAttack2, 2.6k stars), Cve Remediation (rundeck/rundeck, 6.3k stars) and Native Dependency Update (mono/SkiaSharp, 5.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Cveapi?

taracodlabs (a GitHub organization) maintains it in taracodlabs/aiden, which has 849 GitHub stars. The repository holds 63 skills in this directory. The repository was last updated on September 13, 2026.

Source: taracodlabs/aiden on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Cveapi

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

CVE API — Vulnerability Lookup

When to Use

How to Use

Look up a single CVE (MITRE CVE API)

Look up via NVD (richer data, optional API key)

Batch lookup — check multiple CVEs

Examples

Cautions

Requirements

Files

Compare with similar skills

Similar skills

More from taracodlabs/aiden

Related

Questions about Cveapi