skills.rest
notque
notqueCOMMUNITY
Explore all skills by this author →
GitHub

cve-source-check

Map inventory components to authoritative CVE feeds and generate coverage reports.

415|44|Updated Mar 18, 2026
Search Tags:#reporting#cve#security-audit#feed-monitoring#url-verification#vulnerability-mgmt#dependency-coverage
One-click install
npx skills add https://github.com/notque/vexjoy-agent --skill cve-source-check
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cve-source-check
Source: https://github.com/notque/vexjoy-agent/tree/main/skills/infrastructure/cve-source-check
Command: npx skills add https://github.com/notque/vexjoy-agent --skill cve-source-check

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies whether your technology stack is covered by authoritative CVE and vulnerability sources, and it highlights exactly which components or feeds are missing so you can close the gap before incomplete security work ships.

Core Features & Use Cases

  • Component-to-feed mapping: Resolves each inventory component (including name aliases) against a versioned registry of authoritative CVE/vulnerability sources.
  • Monitored-feed gap detection: Compares the registry’s sources against your currently monitored feed list to flag unmonitored required feeds.
  • Optional URL reachability verification: Best-effort HEAD checks to detect unreachable source URLs without blocking the audit.
  • Audit-ready reporting: Produces both Markdown (human review) and JSON (machine consumption) reports with clear exit codes (coverage gaps vs input errors vs unreachable links).

Quick Start

Ask the agent to audit CVE source coverage for your service using your component inventory file and your currently monitored CVE feed URLs, then output a Markdown and JSON audit report.

Frequently Asked Questions about cve-source-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my CVE feed coverage for missing vulnerability sources?▼

Auditing CVE feed coverage resolves each component in your JSON inventory against authoritative security sources, flagging unmonitored feeds and generating Markdown or JSON reports with deterministic exit codes for gaps.

What is component-to-feed mapping for vulnerability management?▼

Component-to-feed mapping resolves each inventory item, including name aliases for containers and libraries, against a versioned registry of authoritative CVE sources to identify exact missing vulnerability feeds.

Can I verify URL reachability of CVE feeds during a security audit?▼

You can verify URL reachability using optional best-effort HEAD checks to detect unreachable source URLs without blocking the audit, returning specific exit codes for broken links versus coverage gaps.

Does the vulnerability source audit work with container base images and runtimes?▼

The audit applies to containers, libraries, base images, and runtimes by resolving component aliases from your inventory against versioned registries to ensure infrastructure compliance workflows have evidence-based coverage.

How do I generate an audit-ready report for unmonitored CVE feeds?▼

Generate audit-ready reports by parsing your JSON inventory and monitored feed list, outputting both Markdown for human review and JSON for machine consumption to highlight missing vulnerability sources and coverage gaps.

Why does my security feed audit return an exit code for input errors?▼

The audit uses exit-code signaling to differentiate coverage gaps, input errors, and unreachable links, returning specific codes when JSON inventory parsing or registry-based component resolution fails.

Related Skills

Explore More Software Engineering Skills→
siriwatknpsiriwatknp
2.4k

writing-registry-meta

Generates JSON meta files with required fields for MUI Treasury registry components.

Community
Basic
augustsclaugustscl
2

clawdefender

Detect prompt injection, command injection, SSRF, and path traversal in untrusted inputs.

Community
Advanced
alexandephiliaalexandephilia

codebase-context

Index project codebases to generate stack, structure, and component inventories.

Community
Intermediate
statick88statick88
1

vulnerability-scanning

Automate vulnerability detection across code, dependencies, containers, and infrastructure.

Community
Advanced