Deepsec Documentation Guide
vercel-labs/deepsec
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
Retrieve CVE risk scores from NVD. An agent skill from transilienceai/communitytools.
Install Cve Risk Score
$ npx skills add transilienceai/communitytools --skill cve-risk-score -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install transilienceai/communitytools cve-risk-score --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/cve-risk-score .claude/skills/cve-risk-score && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "cve-risk-score" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cve-risk-score into .claude/skills/cve-risk-score/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cve-risk-score", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/transilienceai/communitytools/tree/main/skills/cve-risk-scoreType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add transilienceai/communitytools --skill cve-risk-score -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install transilienceai/communitytools cve-risk-score --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/cve-risk-score .agents/skills/cve-risk-score && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "cve-risk-score" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cve-risk-score into .agents/skills/cve-risk-score/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cve-risk-score", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add transilienceai/communitytools --skill cve-risk-score -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install transilienceai/communitytools cve-risk-score --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/cve-risk-score .cursor/skills/cve-risk-score && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "cve-risk-score" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cve-risk-score into .cursor/skills/cve-risk-score/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cve-risk-score", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/transilienceai/communitytools.git --path skills/cve-risk-score--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add transilienceai/communitytools --skill cve-risk-score -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install transilienceai/communitytools cve-risk-score --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/cve-risk-score .gemini/skills/cve-risk-score && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "cve-risk-score" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cve-risk-score into .gemini/skills/cve-risk-score/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cve-risk-score", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install transilienceai/communitytools cve-risk-scoreInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add transilienceai/communitytools --skill cve-risk-score -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/cve-risk-score .github/skills/cve-risk-score && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "cve-risk-score" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cve-risk-score into .github/skills/cve-risk-score/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cve-risk-score", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add transilienceai/communitytools --skill cve-risk-score -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install transilienceai/communitytools cve-risk-score --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/cve-risk-score .opencode/skills/cve-risk-score && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "cve-risk-score" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cve-risk-score into .opencode/skills/cve-risk-score/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cve-risk-score", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
cve-risk-score- GitHub stars
- 563
- Token cost
- ~565 tokens
- SKILL.md length
- 264 words
- Files
- 2
- Skills in repo
- 35
- Repo updated
- First seen
- Licence
- MIT
At a glance
Retrieve CVE risk scores from NVD. An agent skill from transilienceai/communitytools.
- Works in 4 steps: Extract CVE IDs from the user's message… → Run the lookup script → Present the results in a concise table… → …
- Tasks that involve Vulnerability scanning
- SKILL.md covers Trigger, Workflow, Output Format and Rules, plus 1 more section
- Calls python3; needs NVD_API_KEY
What it does
Cve Risk Score is an agent skill from transilienceai/communitytools. Retrieve CVE risk scores from NVD. Auto-invoked whenever a CVE ID is mentioned to display CVSS score, severity, CWE, and description.
Its SKILL.md is about 570 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `reference/nvd-api-reference.md`).
It sits in Security, covering Vulnerability scanning. The repository describes itself as: Open-source Claude Code skills, agents, and slash commands for AI-powered penetration testing, bug bounty hunting, and security research. The licence is MIT.
When your agent uses it
- Tasks that involve Vulnerability scanning
Example prompts
- “/cve-risk-score”
Requirements
- Python 3
- A credential in NVD_API_KEY
Workflow steps
4 steps, taken from the first numbered list in SKILL.md.
- Extract CVE IDs from the user's message or tool output (regex: CVE-\d{4}-\d{4,})
- Run the lookup script
- Present the results in a concise table format
- Continue with the user's original task — the score lookup is supplementary context, not a blocking step.
What it can do on your machine
Read from SKILL.md and the folder at commit 95fdc12. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
python3
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
NVD_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Cve Risk Score loads about 565 tokens when it runs. Until then it costs about 37 tokens; SKILL.md has 264 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteMentions a .env fileSKILL.md:46
*API key** — if `NVD_API_KEY` is set in `.env`, the script uses it for higher rate limits.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from transilienceai/communitytools at commit 95fdc12, republished under its MIT licence (© transilienceai). 264 words, ~565 tokens.
Download SKILL.mdSave it as
.claude/skills/cve-risk-score/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- cve-risk-score
- description
- Retrieve CVE risk scores from NVD. Auto-invoked whenever a CVE ID is mentioned to display CVSS score, severity, CWE, and description.
CVE Risk Score
Fetch and display CVE risk scores from the National Vulnerability Database (NVD) whenever a CVE ID appears in conversation.
Trigger
This skill MUST be invoked automatically whenever a CVE ID (pattern CVE-YYYY-NNNNN) is mentioned by the user or discovered during research/scanning. Do not wait for explicit invocation.
Workflow
Extract CVE IDs from the user's message or tool output (regex:
CVE-\d{4}-\d{4,})Run the lookup script:
bash python3 tools/nvd-lookup.py CVE-XXXX-XXXXX [CVE-YYYY-YYYYY ...]Present the results in a concise table format:
CVE ID Score Severity CWE Description CVE-XXXX-XXXXX 9.8 CRITICAL CWE-79 ... Continue with the user's original task — the score lookup is supplementary context, not a blocking step.
Output Format
When presenting CVE risk scores inline, use this compact format:
CVE-2024-12345: 9.8 CRITICAL (CWE-79) — Remote code execution via ...For multiple CVEs, use a markdown table.
Rules
- Always invoke — every CVE ID mentioned triggers a lookup. No exceptions.
- Non-blocking — fetch scores in parallel with other work when possible.
- Accurate data only — display exactly what NVD returns. Never estimate or fabricate scores.
- Graceful degradation — if NVD is unreachable or the CVE has no score yet, say so explicitly (e.g., "Not yet scored by NVD").
- Rate limiting — the script handles rate limits internally. For bulk lookups (5+), warn that NVD throttles unauthenticated requests.
- API key — if
NVD_API_KEYis set in.env, the script uses it for higher rate limits.
Integration
This skill complements other skills:
- cve-poc-generator: After seeing the risk score, the user may want a full PoC and report
- reconnaissance / source-code-scanning: When these skills discover CVEs in dependencies, auto-lookup their scores
- coordination: CVE scores inform priority and severity classification in findings
© transilienceai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file in skills/cve-risk-score of transilienceai/communitytools.
- SKILL.md
- reference/nvd-api-reference.md
Open the folder on GitHubat commit 95fdc12
Compare with similar skills
Cve Risk Score next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Cve Risk Score this skilltransilienceai/communitytools | 563 | — | ~565 | Automated safety check: Notes | MIT | |
| Deepsec Documentation Guidevercel-labs/deepsec | 8.1k | — | ~956 | Automated safety check: Pass | Apache-2.0 | |
| Shiro Attack CLISummerSec/ShiroAttack2 | 2.6k | — | ~945 | Automated safety check: Pass | MIT | |
| Cve Remediationrundeck/rundeck | 6.3k | — | ~2.9k | Automated safety check: Pass | Apache-2.0 | |
| Native Dependency Updatemono/SkiaSharp | 5.6k | — | ~4.1k | Automated safety check: Pass | MIT | |
| Forensifyalexgreensh/repo-forensics | 190 | — | ~2.5k | Automated safety check: Notes | Custom licence |
Similar skills
- Official
Shiro Attack CLI
SummerSec/ShiroAttack2
当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…
Cve Remediation
rundeck/rundeck
Verify if a CVE affects the project and remediate it. An agent skill from rundeck/rundeck.
Native Dependency Update
mono/SkiaSharp
Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.
Forensify
alexgreensh/repo-forensics
Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.
Write Cve Rule
evdenis/cvehound
Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.
More from transilienceai/communitytools
All 35 skills in this repoDfir
transilienceai/communitytools
Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.
GitHub Workflow
transilienceai/communitytools
GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review.
Pci Secure Software
transilienceai/communitytools
Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation.
Protect With Password
transilienceai/communitytools
Generate ONE strong password and apply it to each referenced file (PDF, Word, Excel, PowerPoint, or any type).
Skill Update
transilienceai/communitytools
Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits.
Source Code Scanning
transilienceai/communitytools
Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.
Related
Categories
Questions about Cve Risk Score
What does Cve Risk Score do?
Retrieve CVE risk scores from NVD. An agent skill from transilienceai/communitytools. Cve Risk Score is an agent skill from transilienceai/communitytools. Retrieve CVE risk scores from NVD.
When should I use Cve Risk Score?
Cve Risk Score fits situations like: tasks that involve Vulnerability scanning.
How do I install Cve Risk Score in Claude Code?
Run `npx skills add transilienceai/communitytools --skill cve-risk-score -a claude-code`. Or copy the skill folder (skills/cve-risk-score in transilienceai/communitytools) into .claude/skills/cve-risk-score in your project. Claude Code loads it when a task matches its description.
How do I install Cve Risk Score in Codex?
Run `npx skills add transilienceai/communitytools --skill cve-risk-score -a codex`. Or copy the skill folder (skills/cve-risk-score in transilienceai/communitytools) into .agents/skills/cve-risk-score in your project. Codex loads it when a task matches its description.
Can I use Cve Risk Score in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add transilienceai/communitytools --skill cve-risk-score -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cve-risk-score, .gemini/skills/cve-risk-score, .github/skills/cve-risk-score and .opencode/skills/cve-risk-score in your project.
What does Cve Risk Score need to run?
Going by SKILL.md and its folder, Cve Risk Score needs the command-line tools its instructions call (python3) and credentials named NVD_API_KEY. Our summary lists: Python 3; A credential in NVD_API_KEY.
Does Cve Risk Score access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Cve Risk Score safe to install?
Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Cve Risk Score use?
Cve Risk Score is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Cve Risk Score use?
About 565 tokens (SKILL.md is roughly 2.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Cve Risk Score?
Skills that share tags, products or a category with Cve Risk Score: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Shiro Attack CLI (SummerSec/ShiroAttack2, 2.6k stars), Cve Remediation (rundeck/rundeck, 6.3k stars) and Native Dependency Update (mono/SkiaSharp, 5.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Cve Risk Score?
transilienceai (a GitHub organization) maintains it in transilienceai/communitytools, which has 563 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on July 29, 2026.
Source: transilienceai/communitytools on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.