[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69B3MA6THV4RTY8BK5KC2MH":3,"skill-same:01M69B3MA6THV4RTY8BK5KC2MH":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":26,"frontMatter":27,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":31,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":34,"ownerDescription":35,"updatedAt":36,"install":37,"resources":50},"01M69B3MA6THV4RTY8BK5KC2MH","cve-known-vulnerabilities",null,"Detect known CVEs in Maven, NuGet, or npm dependencies using the GitHub Security Advisories API","microsoft\u002Fgithub-copilot-modernization","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69B2DAY0HTBHWQN4WF3JDBQ",55,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fcve-known-vulnerabilities\u002FSKILL.md",[],[19,20,21,22],"vulnerabilities","cve known vulnerabilities","github","security","2026-11-10 10:12:30",false,"---\nname: cve-known-vulnerabilities\ndescription: Detect known CVEs in Maven, NuGet, or npm dependencies using the GitHub Security Advisories API\nuser-invocable: false\n---\n\n# Local CVE Dependency Assessment\n\nAudit dependencies without modifying application files. Do not call an assessment or CVE MCP tool.\n\n## Inputs\n\n- `workspace-path`: Absolute project root.\n- `output-path`: Required JSON result path supplied by the assessment catalog.\n- `scan-scope`: `direct` (default) or `all`.\n\n## 1. Detect Ecosystem\n\n- Maven\u002FGradle project → advisory ecosystem `maven`.\n- `.sln`, `.slnx`, or project files → `nuget`.\n- `package.json` → `npm`.\n- If none apply, write `[]` to `output-path` and stop.\n\n## 2. Collect Dependencies\n\nPrefer project wrappers and structured command output. Never edit manifests or lock files.\n\n### Maven\u002FGradle\n\n- Maven: run `.\u002Fmvnw dependency:list -DoutputAbsoluteArtifactId=true`; add `-DexcludeTransitive=true` for direct scope. Fall back to `mvn`, then static `pom.xml` parsing.\n- Gradle: run `.\u002Fgradlew dependencies --configuration runtimeClasspath`; fall back to `gradle`, then static `build.gradle`\u002F`build.gradle.kts` parsing.\n- Coordinate format: `groupId:artifactId:version`.\n\n### NuGet\n\n- Run `dotnet list package --format json`; add `--include-transitive` for all scope.\n- If no solution exists at the root, target each discovered project explicitly.\n- Fall back to `PackageReference`, `Directory.Packages.props`, and `packages.config` parsing.\n- Coordinate format: `PackageName@version`.\n\n### npm\n\n- Run `npm list --json`; add `--depth=0` for direct scope.\n- Fall back to `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, then `package.json`.\n- Coordinate format: `package-name@version`.\n\nFor each dependency retain its manifest path and 1-based declaration line when directly declared; use line `0` for transitive dependencies.\n\n## 3. Query GitHub Advisories\n\nBatch coordinates in groups of at most 30. Use `gh api` when available:\n\n```text\n\u002Fadvisories?ecosystem=\u003Cmaven|nuget|npm>&affects=\u003Curl-encoded-coordinates>&per_page=100\n```\n\nFollow pagination. If `gh` is unavailable, use the GitHub REST API with `GITHUB_TOKEN` when present. Never use general web search for vulnerability conclusions.\n\nIf one batch fails, record the error and continue remaining batches. A failed query must not silently become a clean scan: return a wrapper with `status: partial` and the failed batch details instead of `[]`.\n\n## 4. Normalize Results\n\n- Ignore withdrawn advisories.\n- Use `cve_id`, falling back to `ghsa_id`.\n- Deduplicate the same advisory across dependency batches.\n- Map severity: critical\u002Fhigh → `mandatory`; medium → `optional`; low\u002Funknown → `potential`.\n- Group all affected dependencies for one advisory into one finding.\n- Include advisory URL, vulnerable range, first patched version, and manifest evidence.\n\n## Output\n\nOn a complete scan, write a flat JSON array to `output-path`; use `[]` only when every query succeeded and no vulnerability was found:\n\n```json\n[\n  {\n    \"id\": \"CVE-2024-0001\",\n    \"name\": \"Advisory summary\",\n    \"status\": \"FOUND\",\n    \"category\": \"CVE\",\n    \"severity\": \"mandatory\",\n    \"storyPoint\": 1,\n    \"evidence\": {\n      \"files\": [\"pom.xml:42\"],\n      \"explanation\": \"Advisory URL, affected coordinates, vulnerable range, and patched version\"\n    }\n  }\n]\n```\n\nWhen any advisory batch fails, write:\n\n```json\n{\n  \"input_name\": \"CVE dependency assessment\",\n  \"analysis_method\": \"GitHub Security Advisories API\",\n  \"status\": \"partial\",\n  \"result\": {\n    \"finding\": \"CVE scan completed with one or more failed advisory batches\",\n    \"confidence\": \"low\",\n    \"evidence\": [\"\u003Cfailure details>\"],\n    \"values\": [\"\u003Call successfully returned FOUND findings>\"]\n  }\n}\n```\n\nWrite the output exactly once using a temporary file followed by atomic rename. Return only the output path and concise counts to the parent assessment.","# Local CVE Dependency Assessment\n\nAudit dependencies without modifying application files. Do not call an assessment or CVE MCP tool.\n\n## Inputs\n\n- `workspace-path`: Absolute project root.\n- `output-path`: Required JSON result path supplied by the assessment catalog.\n- `scan-scope`: `direct` (default) or `all`.\n\n## 1. Detect Ecosystem\n\n- Maven\u002FGradle project → advisory ecosystem `maven`.\n- `.sln`, `.slnx`, or project files → `nuget`.\n- `package.json` → `npm`.\n- If none apply, write `[]` to `output-path` and stop.\n\n## 2. Collect Dependencies\n\nPrefer project wrappers and structured command output. Never edit manifests or lock files.\n\n### Maven\u002FGradle\n\n- Maven: run `.\u002Fmvnw dependency:list -DoutputAbsoluteArtifactId=true`; add `-DexcludeTransitive=true` for direct scope. Fall back to `mvn`, then static `pom.xml` parsing.\n- Gradle: run `.\u002Fgradlew dependencies --configuration runtimeClasspath`; fall back to `gradle`, then static `build.gradle`\u002F`build.gradle.kts` parsing.\n- Coordinate format: `groupId:artifactId:version`.\n\n### NuGet\n\n- Run `dotnet list package --format json`; add `--include-transitive` for all scope.\n- If no solution exists at the root, target each discovered project explicitly.\n- Fall back to `PackageReference`, `Directory.Packages.props`, and `packages.config` parsing.\n- Coordinate format: `PackageName@version`.\n\n### npm\n\n- Run `npm list --json`; add `--depth=0` for direct scope.\n- Fall back to `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, then `package.json`.\n- Coordinate format: `package-name@version`.\n\nFor each dependency retain its manifest path and 1-based declaration line when directly declared; use line `0` for transitive dependencies.\n\n## 3. Query GitHub Advisories\n\nBatch coordinates in groups of at most 30. Use `gh api` when available:\n\n```text\n\u002Fadvisories?ecosystem=\u003Cmaven|nuget|npm>&affects=\u003Curl-encoded-coordinates>&per_page=100\n```\n\nFollow pagination. If `gh` is unavailable, use the GitHub REST API with `GITHUB_TOKEN` when present. Never use general web search for vulnerability conclusions.\n\nIf one batch fails, record the error and continue remaining batches. A failed query must not silently become a clean scan: return a wrapper with `status: partial` and the failed batch details instead of `[]`.\n\n## 4. Normalize Results\n\n- Ignore withdrawn advisories.\n- Use `cve_id`, falling back to `ghsa_id`.\n- Deduplicate the same advisory across dependency batches.\n- Map severity: critical\u002Fhigh → `mandatory`; medium → `optional`; low\u002Funknown → `potential`.\n- Group all affected dependencies for one advisory into one finding.\n- Include advisory URL, vulnerable range, first patched version, and manifest evidence.\n\n## Output\n\nOn a complete scan, write a flat JSON array to `output-path`; use `[]` only when every query succeeded and no vulnerability was found:\n\n```json\n[\n  {\n    \"id\": \"CVE-2024-0001\",\n    \"name\": \"Advisory summary\",\n    \"status\": \"FOUND\",\n    \"category\": \"CVE\",\n    \"severity\": \"mandatory\",\n    \"storyPoint\": 1,\n    \"evidence\": {\n      \"files\": [\"pom.xml:42\"],\n      \"explanation\": \"Advisory URL, affected coordinates, vulnerable range, and patched version\"\n    }\n  }\n]\n```\n\nWhen any advisory batch fails, write:\n\n```json\n{\n  \"input_name\": \"CVE dependency assessment\",\n  \"analysis_method\": \"GitHub Security Advisories API\",\n  \"status\": \"partial\",\n  \"result\": {\n    \"finding\": \"CVE scan completed with one or more failed advisory batches\",\n    \"confidence\": \"low\",\n    \"evidence\": [\"\u003Cfailure details>\"],\n    \"values\": [\"\u003Call successfully returned FOUND findings>\"]\n  }\n}\n```\n\nWrite the output exactly once using a temporary file followed by atomic rename. Return only the output path and concise counts to the parent assessment.",{"name":5,"description":7,"user-invocable":24},"main","a9c9469d86e9dc078018e8fb391abc7744088078","plugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fcve-known-vulnerabilities",15,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-09-24 00:17:59",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add microsoft\u002Fgithub-copilot-modernization --skill cve-known-vulnerabilities",{"tool":43,"command":44},"bunx","bunx skills add microsoft\u002Fgithub-copilot-modernization --skill cve-known-vulnerabilities",{"tool":46,"command":47},"pnpm","pnpm dlx skills add microsoft\u002Fgithub-copilot-modernization --skill cve-known-vulnerabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fcve-known-vulnerabilities\u002FSKILL.md",true,[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"references\u002Fstandalone-harness.md","REFERENCE","参考文档",44170,"https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fheygen-com_hyperframes\u002Fslideshow\u002Freferences\u002Fstandalone-harness.md",[58,72,81,90,99,107],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":69,"publishedAt":23},"01M69B5DBRA354JMQRZP3D1X3X","verify-test-baseline","Generate and run post-migration tests from the frozen baseline specification.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fverify-test-baseline\u002FSKILL.md",[64],{"categoryNo":65,"categoryName":66,"taxonomyType":67,"taxonomyTypeDesc":68},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[70,71],"test","verify test baseline",{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":23},"01M69B5BJWPCN41J5ZAR2XFMBR","team-request","How team members request infrastructure connection info and handle secrets in team mode","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fteam-request\u002FSKILL.md",[],[79,80],"team request","infrastructure",{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":23},"01M69B58TZ7SNTPB6C508M5HWX","team-charters","Provides role charters (mission, ownership, core principles, quality bar) for a multi-agent coding team. Each charter defines the role's mission, ownership scope, core principle (boundary constraints), and quality bar. Most roles also include communication rules. Consumed by the coordinator during task decomposition to assign work to the correct role.\nTriggers: \"look up role charter\", \"what does the architect own\", \"check role boundaries\", \"find team roles\", \"which role handles X\", \"list agent charters\", \"role responsibilities\".\nNOT for: task decomposition (use breaking-down-tasks), implementation (use implementing-code), architecture analysis (use analyzing-architecture).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fteam-charters\u002FSKILL.md",[],[88,89],"team charters","architecture",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":23},"01M69B56JVPKCS2WWVSCZXHEZJ","struts-to-spring","Migration guideline for transforming Apache Struts 2 applications to Spring Boot 3.x and Spring MVC.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fstruts-to-spring\u002FSKILL.md",[],[97,98],"struts to spring","boot",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":23},"01M69B54QQ6K8SDZ8MJYEKBYHJ","spring-boot-scaffolding","Reference guide for creating a new Spring Boot project during rewrite migration.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fspring-boot-scaffolding\u002FSKILL.md",[],[98,106],"spring boot scaffolding",{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":23},"01M69B52T5G9CZWHYXWP22WEKY","sharing-learnings","How to record project learnings so that later-phase workers and future agent runs can consume them.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fsharing-learnings\u002FSKILL.md",[],[114],"sharing learnings"]