Cvss score extraction

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-claude-haiku-4-5/dependency-vulnerability-check/cvss-score-extraction

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill cvss-score-extraction

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Extract and handle CVSS scores from multiple vulnerability data sources (NVD, GHSA, RedHat) with proper fallback priority.

SKILL.md

3.3 KB, as published. Nobody here has run it

CVSS Score Extraction

Overview

CVSS (Common Vulnerability Scoring System) scores quantify vulnerability severity from 0-10. Different sources may provide different scores, requiring intelligent fallback handling.

Score Sources

NVD (National Vulnerability Database)

Official US government vulnerability database
Provides CVSS v3.0 and v3.1 scores
Most comprehensive coverage
URL pattern: https://nvd.nist.gov/vuln/detail/{CVE_ID}

GHSA (GitHub Security Advisory)

GitHub's vulnerability advisory database
Integrated with npm ecosystem
URL pattern: https://github.com/advisories/{GHSA_ID}

RedHat Security

RedHat-specific vulnerability data
Often has additional context
URL pattern: https://access.redhat.com/security/cve/{CVE_ID}

Source Priority

For optimal results, use this priority:

NVD CVSS v3.1 (most reliable, modern scoring)
NVD CVSS v3.0 (fallback, still reliable)
GHSA CVSS (GitHub advisory ecosystem)
RedHat CVSS (distribution-specific)
N/A (if no score available)

Data Extraction Pattern

def extract_cvss_score(vuln_data):
    """
    Extract CVSS score with source priority fallback.

    vuln_data: vulnerability object from Trivy or similar
    returns: (score, source) tuple
    """

    # Check NVD first (most authoritative)
    if 'nvd_cvss_v3_1' in vuln_data:
        return (vuln_data['nvd_cvss_v3_1'], 'NVD')

    if 'nvd_cvss_v3_0' in vuln_data:
        return (vuln_data['nvd_cvss_v3_0'], 'NVD')

    # Check GitHub Advisory
    if 'ghsa_cvss' in vuln_data:
        return (vuln_data['ghsa_cvss'], 'GHSA')

    # Check RedHat
    if 'redhat_cvss' in vuln_data:
        return (vuln_data['redhat_cvss'], 'RedHat')

    # No score available
    return ('N/A', 'Unknown')

Handling Missing Scores

When CVSS scores are unavailable:

def get_cvss_with_fallback(cve_id, vuln_sources):
    """
    Query multiple sources for CVSS score.

    cve_id: CVE identifier (e.g., CVE-2021-12345)
    vuln_sources: list of available data sources
    returns: (score_value, source_name)
    """

    for source in vuln_sources:
        score = source.get_cvss(cve_id)
        if score:
            return (score, source.name)

    # Fallback: use severity level as proxy
    return ('N/A', 'No Score Available')

Common Patterns

Trivy Integration

Trivy may not always include CVSS scores. For missing scores:

def enrich_with_cvss(trivy_results):
    """Enrich Trivy results with CVSS scores from NVD"""
    enriched = []

    for vuln in trivy_results:
        cve_id = vuln['VulnerabilityID']
        score = vuln.get('CVSS', {}).get('nvd', {}).get('V3Score', 'N/A')

        vuln['cvss_score'] = score
        enriched.append(vuln)

    return enriched