About cve-research
CVE Research is a skill for checking known vulnerabilities in a single dependency. It is for developers assessing dependency risk and cross-references OSV.dev, NVD, GitHub Advisory, and Exa, then reports prioritization, fix versions, and workarounds.
Key features
- 01Queries multiple vulnerability sources
- 02Cross-checks reported findings
- 03Prioritizes by CVSS and exploitability
- 04Reports fix versions and workarounds
- 05Limited to one dependency at a time
Use cases
- 01Check a dependency for vulnerabilities before merging
- 02Prioritize remediation for discovered CVEs
- 03Find a dependency's fix version or workaround
MCP support
The skill uses Exa MCP for real-time web search; other vulnerability sources are queried through their respective APIs.
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/cve-researchin Claude Code to confirm it loaded.
Details
From the project READMEIt queries OSV.dev first for speed and accuracy, cross-checks NVD for CVSS scoring, uses Exa for recent advisories, and checks GitHub Advisory for maintainer responses, then cross-references findings and prioritizes by CVSS score and exploitability — CRITICAL (9.0-10.0) fixed immediately, HIGH (7.0-8.9) before merge, MEDIUM (4.0-6.9) planned, LOW (0.1-3.9) documented — reporting fix versions and workarounds.
Out of scope: this is a single-dependency lookup, not a full project dependency sweep (use dependency-audit for that).
CVE Research Skill
Overview
Research known vulnerabilities for project dependencies using multiple sources.
Data Sources
| Source | API | Coverage |
|---|---|---|
| NVD | nvd.nist.gov/vuln/api | All CVEs |
| OSV.dev | api.osv.dev | npm, PyPI, Go, crates, Maven |
| GitHub Advisory | github.com/advisories | npm, pip, composer, cargo |
| Exa Search | Via MCP | Real-time web search |
Workflow
- Extract dependencies from project (package.json, etc.)
- Query each source for known CVEs
- Cross-reference findings across sources
- Prioritize by CVSS score and exploitability
- Report with fix versions and workarounds
Query Strategy
For each dependency:
- Search OSV.dev first (fastest, most accurate for packages)
- Cross-check NVD for CVSS scoring
- Use Exa for recent advisories not yet in databases
- Check GitHub Advisory for maintainer responses
Severity Mapping
| CVSS Score | Severity | Action |
|---|---|---|
| 9.0 - 10.0 | CRITICAL | Fix immediately |
| 7.0 - 8.9 | HIGH | Fix before merge |
| 4.0 - 6.9 | MEDIUM | Plan fix |
| 0.1 - 3.9 | LOW | Document |