agentsclimarketplace

Cvss score extraction

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-claude-opus-4-6/dependency-vulnerability-check/cvss-score-extraction

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install
npx -y skills add cxcscmu/SkillLearnBench --skill cvss-score-extraction

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Extract CVSS (Common Vulnerability Scoring System) scores from vulnerability data sources with proper fallback handling. This skill covers understanding CVSS v3, handling multiple score sources (NVD, GHSA, RedHat), implementing source priority logic, and dealing with missing scores in security reporting.

SKILL.md

1.4 KB, 329 tokens by cl100k_base, as published. Nobody here has run it

CVSS Score Extraction

Extract CVSS v3 scores from vulnerability data using a source priority cascade.

Source Priority

NVD → GHSA → RedHat → N/A

NVD (National Vulnerability Database) is most authoritative, followed by GitHub Security Advisories, then RedHat.

Data Structure (Trivy Format)

{
  "CVSS": {
    "nvd": { "V3Score": 9.8, "V2Score": 7.5 },
    "ghsa": { "V3Score": 9.8 }
  }
}

Python Implementation

def get_cvss_score(vuln_data):
    """Extract CVSS v3 score with source priority: NVD > GHSA > RedHat."""
    cvss = vuln_data.get('CVSS', {})
    if not isinstance(cvss, dict):
        return 'N/A'
    for source in ['nvd', 'ghsa', 'redhat']:
        if source in cvss and isinstance(cvss[source], dict):
            score = cvss[source].get('V3Score')
            if score is not None and isinstance(score, (int, float)):
                return score
    return 'N/A'

Score Ranges

ScoreSeverity
9.0-10.0Critical
7.0-8.9High
4.0-6.9Medium
0.1-3.9Low

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.