generate-cve-json

Generate deterministic CVE 5.x JSON records from GitHub tracking issues.

79|76|Updated Apr 28, 2026
One-click install
npx skills add https://github.com/apache/airflow-steward --skill generate-cve-json
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: generate-cve-json
Source: https://github.com/apache/airflow-steward/tree/main/tools/vulnogram/generate-cve-json
Command: npx skills add https://github.com/apache/airflow-steward --skill generate-cve-json

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill generates a deterministic CVE 5.x JSON record from a GitHub tracking issue, enabling rapid paste-ready CVE entries for Vulnogram without manual repetitive data entry.

Core Features & Use Cases

  • Reads tracker issues and extracts standard fields to build a CVE 5.x envelope.
  • Supports multiple credits (reporter and remediation developers) and multiple references (PRs, advisory URLs).
  • Produces a deterministic JSON document that can be re-generated for diffs and audits.

Quick Start

Read an issue body (or supply it via stdin), run the tool, and obtain a ready-to-paste CVE JSON record.

Frequently Asked Questions about generate-cve-json

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a CVE JSON record from a GitHub tracking issue?

To generate a CVE JSON record, you provide a GitHub tracking issue body and the tool extracts standard fields to output a ready-to-paste CVE 5.x envelope for Vulnogram. This eliminates manual data entry for vulnerability disclosures.

What is the best way to automate CVE 5.x JSON creation for Vulnogram?

Automating CVE 5.x JSON creation is best handled by parsing tracker issues directly into a deterministic JSON document. This approach ensures outputs can be re-generated consistently for reliable diffs and security audits without manual formatting.

Can I include multiple credits and references when generating a CVE JSON file?

Yes, you can include multiple credits and references when generating a CVE JSON file. The tool supports adding multiple reporter and remediation developer credits, alongside multiple references such as pull requests and advisory URLs.

Do I need external dependencies to create deterministic CVE JSON from trackers?

You do not need external dependencies to create deterministic CVE JSON. The tool relies only on the Python standard library and the GitHub CLI for live data access, ensuring reproducible results without complex environment setups.

How does deterministic JSON generation help with security audits?

Deterministic JSON generation helps with security audits by producing identical output for the same input data. This allows security teams to accurately diff records over time and verify changes without manual review noise.

Can I use GitHub CLI data to populate Vulnogram CVE records?

Yes, you can use GitHub CLI data to populate Vulnogram CVE records. The tool accesses live tracker issue data via the GitHub CLI and formats it into a paste-ready JSON envelope compatible with Vulnogram.