skills.rest
camgrimsec
camgrimsecCOMMUNITY
Explore all skills by this author →
GitHub

threat-intel-monitor

Correlate newly disclosed CVEs with dependency inventories from multiple threat-intel feeds.

3|1|Updated Apr 13, 2026
Search Tags:#monitoring#vulnerability#devsecops#cve#dependency#threat-intel
One-click install
npx skills add https://github.com/camgrimsec/grimsec-suite --skill threat-intel-monitor
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-intel-monitor
Source: https://github.com/camgrimsec/grimsec-suite/tree/main/agents/05-threat-intel-monitor
Command: npx skills add https://github.com/camgrimsec/grimsec-suite --skill threat-intel-monitor

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

The skill continuously tracks newly disclosed vulnerabilities from multiple threat‑intel feeds (CISA KEV, OSV.dev, NVD, GitHub Advisories) and cross‑references them with the dependency inventories produced by the repo analyzer, revealing which of your projects are now exposed.

Core Features & Use Cases

  • Multi‑source monitoring: Aggregates data from CISA KEV, OSV.dev, NVD, and GitHub Advisory databases.
  • Dependency cross‑reference: Matches CVEs against inventory.json files from previously analyzed repositories.
  • Exposure classification: Labels findings as EXPOSED, POTENTIALLY_EXPOSED, or NOT_AFFECTED with severity tiers.
  • Reporting: Generates JSON and markdown executive summaries and supports scheduled runs via cron.
    Use case example: After a weekly repo analysis, run the threat‑intel‑monitor to obtain an immediate report of any new high‑severity CVEs affecting your libraries, enabling prompt patching.

Quick Start

Ask the threat‑intel‑monitor skill to run a one‑time scan for the past seven days and produce a summary report.

Frequently Asked Questions about threat-intel-monitor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect newly disclosed CVEs in my project dependencies?▼

You detect newly disclosed CVEs by aggregating threat intelligence from CISA KEV, OSV.dev, NVD, and GitHub Advisories, and cross-referencing those feeds against your project's dependency inventory to reveal exposed libraries.

What sources are used for monitoring vulnerabilities and threat intel?▼

Vulnerability monitoring aggregates data from multiple threat intel sources: the CISA KEV feed, OSV.dev batch API, NVD API, and optionally GitHub Advisory databases using a GitHub token. These sources are cross-referenced with dependencies.

Do I need an inventory.json file to check for vulnerable dependencies?▼

Yes, an inventory.json file produced by the devsecops-repo-analyzer is required. The monitor cross-references newly disclosed CVEs against these dependency lists across supported ecosystems to classify exposure levels.

Can I generate an executive summary report of high-severity CVEs?▼

Yes, you can generate JSON and markdown executive summaries of high-severity CVEs. After scanning your dependencies, findings are labeled as EXPOSED, POTENTIALLY_EXPOSED, or NOT_AFFECTED with severity tiers to enable prompt patching.

Does the threat intel monitor require an NVD API key to run scans?▼

An NVD API key is optional. The monitor requires Python and the requests library, utilizing the CISA KEV feed and OSV.dev batch API by default, while the NVD key and GitHub token provide supplementary advisory data.

Related Skills

Explore More Software Engineering Skills→
AgentSecOpsAgentSecOps
183

sca-blackduck

Identify open-source component vulnerabilities and license risks across CI/CD pipelines.

Official
Advanced
williamzujkowskiwilliamzujkowski
18

security-advisory-response

Manage security advisories through confidential triage, private patching, and synchronized publication.

Community
Advanced
camgrimseccamgrimsec
3

vulnerability-context-enricher

Aggregate CVE data from multiple sources into enriched vulnerability profiles with risk scores and remediation guidance.

Community
Advanced
naporin0624naporin0624
3

cve-search

Query the NVD CVE database for known vulnerabilities with keyword and severity filters.

Community
Intermediate