Cvss score extraction

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-claude-opus-4-6/dependency-vulnerability-check/cvss-score-extraction

Extract CVSS scores from vulnerability data sources with proper fallback handling across NVD, GHSA, and RedHat sources.From its SKILL.md

Install

npx -y skills add cxcscmu/SkillLearnBench --skill cvss-score-extraction

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.2 KB, 310 tokens by cl100k_base, as published. Nobody here has run it

CVSS Score Extraction

Overview

CVSS (Common Vulnerability Scoring System) scores may come from multiple sources in Trivy output. Implement priority-based extraction with fallbacks.

Trivy CVSS Structure

{
  "CVSS": {
    "nvd": { "V3Score": 9.8, "V3Vector": "..." },
    "ghsa": { "V3Score": 8.1, "V3Vector": "..." },
    "redhat": { "V3Score": 7.5, "V3Vector": "..." }
  }
}

Extraction Priority

NVD (nvd.V3Score) — preferred authoritative source
GHSA (ghsa.V3Score) — GitHub Security Advisory
RedHat (redhat.V3Score) — Red Hat security data
Fall back to empty string or "N/A" if no score available

Python Implementation

def extract_cvss_score(cvss_data):
    """Extract CVSS v3 score with source priority: NVD > GHSA > RedHat."""
    if not cvss_data:
        return ""
    for source in ["nvd", "ghsa", "redhat"]:
        source_data = cvss_data.get(source, {})
        score = source_data.get("V3Score")
        if score is not None:
            return score
    return ""

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.