skills.rest
fusengine
fusengineCOMMUNITY
Explore all skills by this author →
Website𝕏@fusengineGitHub

cve-research

Query NVD, OSV.dev, GitHub Advisory Database, and Exa for dependency CVEs.

22|3|Updated Jan 10, 2026
Search Tags:#security#vulnerability#cve#nvd#dependency scanning#osv#github advisory
One-click install
npx skills add https://github.com/fusengine/agents --skill cve-research
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cve-research
Source: https://github.com/fusengine/agents/tree/main/plugins/security-expert/skills/cve-research
Command: npx skills add https://github.com/fusengine/agents --skill cve-research

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps identify and assess known security vulnerabilities within your project's dependencies, mitigating potential risks before they are exploited.

Core Features & Use Cases

  • Comprehensive Vulnerability Scanning: Queries multiple authoritative databases (NVD, OSV.dev, GitHub Advisory) for known CVEs.
  • Real-time Web Search: Leverages Exa to find the latest advisories not yet indexed in traditional databases.
  • Prioritized Reporting: Ranks vulnerabilities by severity (CVSS score) and provides actionable insights with fix versions.
  • Use Case: Before deploying a new version of your application, run this Skill to ensure none of your project's dependencies have critical or high-severity vulnerabilities.

Quick Start

Research CVEs for the 'lodash' package.

Frequently Asked Questions about cve-research

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check dependencies for known CVEs before deployment?▼

Check dependencies for known CVEs by querying NVD, OSV.dev, and GitHub Advisory databases. This research process identifies security vulnerabilities in project packages, prioritizes findings by CVSS score and exploitability, and provides actionable fix versions before deployment.

What is the best way to find recent security advisories not yet indexed in NVD?▼

Find recent security advisories not in NVD by leveraging real-time web search alongside traditional databases. Querying OSV.dev and utilizing Exa web search uncovers the latest security advisories that have not yet been formally indexed in traditional vulnerability databases.

How are vulnerability findings prioritized during a dependency scan?▼

Vulnerability findings are prioritized during a dependency scan by evaluating their CVSS score and exploitability. This ranking method highlights critical and high-severity vulnerabilities first, providing developers with actionable insights, specific fix versions, and workarounds.

Can I use this to research CVEs for a specific package like lodash?▼

Yes, you can research CVEs for a specific package like lodash. Querying the package name against NVD, OSV.dev, and GitHub Advisory databases returns known vulnerabilities, severity scores, exploitability metrics, and available fix versions for that dependency.

Does vulnerability scanning work for general software development workflows?▼

Yes, vulnerability scanning works for general software development and security auditing workflows. It assesses known security vulnerabilities within project dependencies, mitigating potential risks before they are exploited in a new application version.

Related Skills

Explore More Software Engineering Skills→
dhruvinrsonidhruvinrsoni

dependency-analysis

Analyze project dependencies by building graphs and detecting circular references.

Community
Advanced
Q16GQ16G
83

dependency-audit

Scan project manifests and lockfiles to identify known CVEs.

Community
Intermediate
CenredJunCenredJun

security-auditor

Scan JavaScript, TypeScript, and Python codebases for vulnerabilities and secrets.

Community
Advanced
jonnymuirjonnymuir
1

transitive-vulnerability-overrides

Resolve vulnerable transitive NuGet package warnings with targeted version overrides.

Community
Intermediate