Cvss score extraction

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-claude-sonnet-4-6/dependency-vulnerability-check/cvss-score-extraction

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill cvss-score-extraction

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Extract CVSS (Common Vulnerability Scoring System) scores from Trivy vulnerability JSON output with proper fallback handling across multiple score sources (NVD, GHSA, RedHat). Use this skill whenever processing vulnerability scan results that require numeric severity scores, building security reports, or mapping CVEs to CVSS scores.

SKILL.md

2.3 KB, as published. Nobody here has run it

CVSS Score Extraction

Trivy embeds CVSS scores from multiple sources. Each source may provide V2 and/or V3 scores. Priority order for extraction: NVD → GHSA → RedHat → first available.

Trivy CVSS JSON structure

"CVSS": {
  "nvd": {
    "V2Score": 6.5,
    "V3Score": 8.1,
    "V2Vector": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
    "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  "ghsa": {
    "V3Score": 7.5,
    "V3Vector": "CVSS:3.1/..."
  },
  "redhat": {
    "V3Score": 7.0
  }
}

Python extraction function with fallback

def extract_cvss_score(vuln: dict) -> str:
    """
    Extract best available CVSS score from a Trivy vulnerability dict.
    Prefers V3 over V2. Priority: NVD > GHSA > RedHat > any available.
    Returns score as string, or "N/A" if none found.
    """
    cvss = vuln.get("CVSS", {})
    priority_sources = ["nvd", "ghsa", "redhat"]

    for source in priority_sources:
        scores = cvss.get(source, {})
        # Prefer V3
        if scores.get("V3Score") is not None:
            return str(scores["V3Score"])
        if scores.get("V2Score") is not None:
            return str(scores["V2Score"])

    # Fallback: scan all sources for any score
    for source, scores in cvss.items():
        for key in ["V3Score", "V2Score"]:
            if scores.get(key) is not None:
                return str(scores[key])

    return "N/A"

Edge cases

Missing CVSS key entirely: Return "N/A"
Score is 0.0: This is a valid score (informational), include it — don't treat as missing
Multiple V3 scores differ across sources: Use highest-priority source (NVD first)
Only V2 available: Use it with a note if needed; for CSV output just use the value

Integration example

score = extract_cvss_score(vuln)
row = {
    "CVE_ID": vuln.get("VulnerabilityID", "N/A"),
    "CVSS_Score": score,
    ...
}