Pentest cve poc generator

Skill bertbertov/claude-stack/skills/pentest-cve-poc-generator

A working Claude Code config from a solo builder who ships — 156 skills, 6 hooks, conductor routing pattern, auto-dedupe watch.

Install

npx -y skills add bertbertov/claude-stack --skill pentest-cve-poc-generator

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

CVE research, standalone PoC script and report generation. Given a CVE ID, researches NVD and advisories, generates a safe Python PoC, and writes a detailed vulnerability report.

SKILL.md

2.7 KB, as published. Nobody here has run it

CVE PoC Generator

Research a CVE by ID, generate a standalone Python proof-of-concept script, and produce a detailed vulnerability report.

Workflow

NVD Lookup - Query NVD API v2.0 for the CVE ID. Extract CVSS v3.1 score/vector, CWE IDs, CPE matches, advisory URLs, and patch links.
Advisory Research - Deep-dive vendor advisories, GitHub security advisories, Exploit-DB, and published write-ups. Identify root cause, affected versions, and attack vector details.
PoC Generation - Write a standalone Python script (poc.py) that demonstrates the vulnerability safely. Follow the script standards in reference/poc-methodology.md.
Report Generation - Write a comprehensive markdown report (report.md) with metadata, root cause analysis, risk assessment, and remediation guidance.

NVD Data to Collect

Field	Source	Usage
CVE ID	NVD	Primary identifier
CVSS v3.1 Score + Vector	NVD	Risk scoring
CWE ID(s)	NVD	Vulnerability classification
CPE Matches	NVD	Affected products and versions
Advisory URLs	NVD references	Research sources
Patch Links	NVD references / vendor	Remediation guidance
Description	NVD	Vulnerability summary
Published / Modified dates	NVD	Timeline

Output

outputs/
  processed/cve-pocs/CVE-XXXX-XXXXX/
    poc.py              # Standalone Python PoC script
  reports/cve-pocs/CVE-XXXX-XXXXX/
    report.md           # Detailed vulnerability report

Invocation

/cve-poc-generator CVE-2024-XXXXX

The skill accepts a single CVE ID as argument. Multiple CVEs should be processed with separate invocations.

Rules

Least harm - PoC scripts MUST demonstrate vulnerability without causing damage. Use detection/verification checks, not destructive payloads.
Standalone scripts - PoC must run independently with only standard Python libraries plus requests. No framework dependencies.
Accurate scoring - Use the exact CVSS score and vector from NVD. Do not fabricate or estimate scores.
Source attribution - Every claim in the report must cite its source (NVD, vendor advisory, CVE description).
No emoji - Use text severity labels only (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL).
Verified data only - Do not hallucinate CVE details. If NVD data is unavailable, state it explicitly.
Safe defaults - PoC scripts must default to read-only, non-destructive operations. Any potentially harmful action requires explicit --confirm flag.