Run1 vulnerability csv report generation

Skill cxcscmu/SkillLearnBench/skills/b3-teacher-feedback-claude-opus-4-6/dependency-vulnerability-check/run1_vulnerability-csv-report-generation

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill run1_vulnerability-csv-report-generation

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

How to generate a properly formatted CSV security audit report from vulnerability scan results, including handling of special characters and proper escaping.

SKILL.md

2.5 KB, 596 tokens by cl100k_base, as published. Nobody here has run it

CSV Report Generation for Security Audits

Required Columns

Package,Version,CVE_ID,Severity,CVSS_Score,Fixed_Version,Title,Url

Python CSV Generation

import csv

def write_audit_csv(vulnerabilities, output_path):
    """
    Write vulnerability findings to CSV.
    
    vulnerabilities: list of dicts with keys:
        package, version, cve_id, severity, cvss_score, 
        fixed_version, title, url
    """
    fieldnames = [
        'Package', 'Version', 'CVE_ID', 'Severity',
        'CVSS_Score', 'Fixed_Version', 'Title', 'Url'
    ]
    
    with open(output_path, 'w', newline='') as f:
        writer = csv.DictWriter(f, fieldnames=fieldnames)
        writer.writeheader()
        
        for vuln in vulnerabilities:
            writer.writerow({
                'Package': vuln['package'],
                'Version': vuln['version'],
                'CVE_ID': vuln.get('cve_id', 'N/A'),
                'Severity': vuln['severity'].upper(),
                'CVSS_Score': vuln.get('cvss_score', 'N/A'),
                'Fixed_Version': vuln.get('fixed_version', 'N/A'),
                'Title': vuln.get('title', '').replace('\n', ' '),
                'Url': vuln.get('url', 'N/A')
            })

# Sorting - typically by severity then CVSS score
vulnerabilities.sort(key=lambda x: (
    0 if x['severity'].upper() == 'CRITICAL' else 1,
    -float(x.get('cvss_score', 0) or 0)
))

Important Considerations

Deduplication: Same CVE may appear for the same package at different paths. Deduplicate by (package, version, cve_id) tuple.
CVE ID handling: Some advisories only have GHSA IDs. Map GHSA to CVE when possible. If no CVE, use GHSA ID.
CVSS Score sources (priority order):
- NVD (National Vulnerability Database)
- GHSA (GitHub Security Advisory)
- RedHat Security
Fixed Version:
- Extract from patched_versions field in npm audit
- Or fix.versions in grype
- Or FixedVersion in trivy
- If unavailable, write N/A

Severity filtering: Only include HIGH and CRITICAL:

if vuln['severity'].upper() in ('HIGH', 'CRITICAL'):
    filtered.append(vuln)