Run2 cvss score extraction

Skill cxcscmu/SkillLearnBench/skills/b2-self-feedback-claude-sonnet-4-6/dependency-vulnerability-check/run2_cvss-score-extraction

Extract CVSS v3 scores from Trivy vulnerability JSON with source priority (NVD > GHSA > RedHat) and fallback to N/A.From its SKILL.md

Install

npx -y skills add cxcscmu/SkillLearnBench --skill run2_cvss-score-extraction

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.5 KB, 422 tokens by cl100k_base, as published. Nobody here has run it

CVSS Score Extraction (Round 2)

Priority Order

NVD V3Score → GHSA V3Score → RedHat V3Score → N/A

Do NOT fall back to V2Score — severity labels (HIGH/CRITICAL) come from Trivy's own assessment and are already correct; we only need the numeric score for reporting.

Canonical Implementation

def get_cvss_score(vuln):
    """
    Extract CVSS v3 score with source priority: NVD > GHSA > RedHat.
    Returns float score or string 'N/A'.
    """
    cvss = vuln.get('CVSS', {})
    if not isinstance(cvss, dict):
        return 'N/A'
    for source in ['nvd', 'ghsa', 'redhat']:
        entry = cvss.get(source, {})
        if isinstance(entry, dict):
            score = entry.get('V3Score')
            if score is not None and isinstance(score, (int, float)):
                return score
    return 'N/A'

Real-World Examples from This Task

CVE	NVD	GHSA	RedHat	Result
CVE-2024-29415 (ip)	-	8.1	9.8	8.1 (GHSA wins, NVD absent)
CVE-2022-25883 (semver)	7.5	7.5	7.5	7.5 (NVD wins)
CVE-2026-23745 (tar)	-	-	8.2	8.2 (RedHat only)

Notes

Source keys in Trivy JSON are lowercase: nvd, ghsa, redhat
Only V3Score field is relevant (not V3Vector)
When NVD is absent, GHSA is usually the next best source

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.