Run2 vulnerability extraction
[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.
npx -y skills add cxcscmu/SkillLearnBench --skill run2_vulnerability-extractionAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Robust extraction of vulnerability metadata with CVSS v3 priority and v2 fallback.
SKILL.md
1.4 KB, 348 tokens by cl100k_base, as published. Nobody here has run it
Robust Vulnerability Extraction
This skill provides a more resilient method for extracting security data from scanner outputs.
Robust CVSS Extraction
Prioritize CVSS v3 across multiple sources, falling back to v2 if necessary.
def get_cvss_score(vuln):
cvss = vuln.get('CVSS', {})
if not cvss:
return 'N/A'
# Try V3 Scores first across sources
for source in ['nvd', 'ghsa', 'redhat']:
score = cvss.get(source, {}).get('V3Score')
if score is not None:
return score
# Fallback to V2 Scores
for source in ['nvd', 'ghsa', 'redhat']:
score = cvss.get(source, {}).get('V2Score')
if score is not None:
return score
return 'N/A'
Handling Missing Fields
Always provide defaults for optional fields to prevent None values in reports.
record = {
'Package': vuln.get('PkgName', 'N/A'),
'Version': vuln.get('InstalledVersion', 'N/A'),
'CVE_ID': vuln.get('VulnerabilityID', 'N/A'),
'Severity': vuln.get('Severity', 'N/A'),
'CVSS_Score': get_cvss_score(vuln),
'Fixed_Version': vuln.get('FixedVersion', 'N/A'),
'Title': vuln.get('Title', 'N/A'),
'Url': vuln.get('PrimaryURL', 'N/A')
}