[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KF5GYQY5XWJ8AEFAQV75RK":3,"skill-same:01M6KF5GYQY5XWJ8AEFAQV75RK":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":37,"repositoryHtmlUrl":38,"repositoryHomepageUrl":39,"ownerHtmlUrl":40,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":41,"install":42,"resources":55},"01M6KF5GYQY5XWJ8AEFAQV75RK","run2_npm-vulnerability-scanning-enhanced",null,"Enhanced npm vulnerability scanning with Trivy supporting multiple severity levels and complete metadata extraction","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",92,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-claude-haiku-4-5\u002Fdependency-vulnerability-check\u002Frun2_npm-vulnerability-scanning-enhanced\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28],"npm","vulnerability scanning","vulnerability","scanning","run2 npm vulnerability scanning enhanced","extraction","metadata","severity","trivy","complete","with","2026-11-10 10:12:30",false,"---\nname: run2_npm-vulnerability-scanning-enhanced\ndescription: Enhanced npm vulnerability scanning with Trivy supporting multiple severity levels and complete metadata extraction\n---\n\n# Enhanced npm Dependency Vulnerability Scanning\n\n## Purpose\nScan npm `package-lock.json` files for vulnerabilities using Trivy with complete metadata extraction, including severity sources, vendor data, and multiple reference URLs.\n\n## Key Improvements Over V1\n\n1. **Multiple Severity Sources**: Track severity from different vendors (GHSA, NVD, RedHat)\n2. **Vendor-specific Scoring**: Extract vendor severity codes for better analysis\n3. **Multiple References**: Capture all reference URLs, not just primary\n4. **Data Enrichment**: Include DataSource information for audit trail\n5. **Timestamp Tracking**: Record publication and modification dates\n\n## Installation & Setup\n\n### Prerequisites\n- Trivy 0.40.0+ installed\n- npm package-lock.json file\n- Access to offline vulnerability database\n\n### Setup\n```bash\n# Install Trivy\ncurl -sfL https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Ftrivy\u002Fmain\u002Fcontrib\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n\n# Verify installation\ntrivy --version\n```\n\n## Scan Configuration\n\n### Command with Enhanced Metadata\n```bash\ntrivy fs \u002Froot\u002Fpackage-lock.json \\\n  --format json \\\n  --output vulnerabilities.json \\\n  --scanners vuln \\\n  --skip-db-update \\\n  --severity HIGH,CRITICAL\n```\n\n## JSON Output Structure\n\nEnhanced Trivy output includes:\n\n```json\n{\n  \"Results\": [\n    {\n      \"Target\": \"package-lock.json\",\n      \"Type\": \"npm\",\n      \"Vulnerabilities\": [\n        {\n          \"VulnerabilityID\": \"CVE-2022-25883\",\n          \"PkgName\": \"semver\",\n          \"InstalledVersion\": \"7.3.7\",\n          \"FixedVersion\": \"7.5.2, 6.3.1, 5.7.2\",\n          \"Severity\": \"HIGH\",\n          \"SeveritySource\": \"ghsa\",\n          \"VendorSeverity\": {\n            \"ghsa\": 3,\n            \"nvd\": 7\n          },\n          \"Title\": \"nodejs-semver: Regular expression denial of service\",\n          \"Description\": \"...\",\n          \"PrimaryURL\": \"https:\u002F\u002Favd.aquasec.com\u002Fnvd\u002Fcve-2022-25883\",\n          \"References\": [\n            \"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-25883\",\n            \"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-c2qf-rxjj-qqgw\"\n          ],\n          \"DataSource\": {\n            \"ID\": \"ghsa\",\n            \"Name\": \"GitHub Security Advisory npm\"\n          },\n          \"PublishedDate\": \"2022-11-16T14:15:00Z\",\n          \"LastModifiedDate\": \"2023-09-01T10:00:00Z\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n## Data Extraction Fields\n\nFor each vulnerability record:\n\n| Field | Source | Notes |\n|-------|--------|-------|\n| `VulnerabilityID` | Direct | Primary CVE ID (handle comma-separated) |\n| `PkgName` | Direct | Package name (may include scope) |\n| `InstalledVersion` | Direct | Exact installed version |\n| `FixedVersion` | Direct | First fixed version (may have multiple) |\n| `Severity` | `Severity` field | HIGH or CRITICAL only |\n| `SeveritySource` | Track source | ghsa, nvd, or other |\n| `Title` | Direct | Vulnerability title |\n| `PrimaryURL` | Direct | Primary reference URL |\n| References | Direct | All reference URLs |\n\n## Severity Filtering\n\n### Valid Severities for This Audit\n- HIGH\n- CRITICAL\n\n### Severity Source Priority\n1. GHSA (GitHub) - Most recent data\n2. NVD (NIST) - Most authoritative\n3. RedHat - Vendor-specific\n4. Ubuntu - Ubuntu-specific\n5. Other sources - Use if available\n\n## Vendor Severity Codes\n\nGHSA uses numeric severity codes:\n- 0 = LOW\n- 1 = MODERATE\n- 2 = MEDIUM\n- 3 = HIGH\n- 4 = CRITICAL\n\nNVD uses numeric CVSS scores (0.0-10.0)\n\n## Handling Edge Cases\n\n### Multiple CVE IDs\nSome vulnerabilities may report multiple CVE IDs separated by commas:\n```\n\"CVE-2023-XXXXX, CVE-2023-YYYYY\"\n```\nSplit and process each separately while maintaining package\u002Fversion context.\n\n### Multiple Fixed Versions\nWhen multiple branches are maintained:\n```\n\"FixedVersion\": \"7.5.2, 6.3.1, 5.7.2\"\n```\nExtract the first fixed version for the matched major version if possible.\n\n### Incomplete FixedVersion Data\nSome vulnerabilities may not have fixes:\n```\n\"FixedVersion\": \"\"\n```\nUse \"N\u002FA\" in reports.\n\n## Reference URL Priority\n\n1. `PrimaryURL`: Use as primary reference\n2. `References` array: Include if primary is missing\n3. Construct NVD URL if needed: `https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002F{CVE-ID}`\n\n## Audit Trail Elements\n\nTrack for audit purposes:\n- DataSource.ID: Which database provided the vulnerability info\n- DataSource.Name: Human-readable database name\n- PublishedDate: When the CVE was published\n- LastModifiedDate: When the record was last updated\n\nThis enables tracking which vulnerabilities came from which sources and how current the data is.\n","# Enhanced npm Dependency Vulnerability Scanning\n\n## Purpose\nScan npm `package-lock.json` files for vulnerabilities using Trivy with complete metadata extraction, including severity sources, vendor data, and multiple reference URLs.\n\n## Key Improvements Over V1\n\n1. **Multiple Severity Sources**: Track severity from different vendors (GHSA, NVD, RedHat)\n2. **Vendor-specific Scoring**: Extract vendor severity codes for better analysis\n3. **Multiple References**: Capture all reference URLs, not just primary\n4. **Data Enrichment**: Include DataSource information for audit trail\n5. **Timestamp Tracking**: Record publication and modification dates\n\n## Installation & Setup\n\n### Prerequisites\n- Trivy 0.40.0+ installed\n- npm package-lock.json file\n- Access to offline vulnerability database\n\n### Setup\n```bash\n# Install Trivy\ncurl -sfL https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Ftrivy\u002Fmain\u002Fcontrib\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n\n# Verify installation\ntrivy --version\n```\n\n## Scan Configuration\n\n### Command with Enhanced Metadata\n```bash\ntrivy fs \u002Froot\u002Fpackage-lock.json \\\n  --format json \\\n  --output vulnerabilities.json \\\n  --scanners vuln \\\n  --skip-db-update \\\n  --severity HIGH,CRITICAL\n```\n\n## JSON Output Structure\n\nEnhanced Trivy output includes:\n\n```json\n{\n  \"Results\": [\n    {\n      \"Target\": \"package-lock.json\",\n      \"Type\": \"npm\",\n      \"Vulnerabilities\": [\n        {\n          \"VulnerabilityID\": \"CVE-2022-25883\",\n          \"PkgName\": \"semver\",\n          \"InstalledVersion\": \"7.3.7\",\n          \"FixedVersion\": \"7.5.2, 6.3.1, 5.7.2\",\n          \"Severity\": \"HIGH\",\n          \"SeveritySource\": \"ghsa\",\n          \"VendorSeverity\": {\n            \"ghsa\": 3,\n            \"nvd\": 7\n          },\n          \"Title\": \"nodejs-semver: Regular expression denial of service\",\n          \"Description\": \"...\",\n          \"PrimaryURL\": \"https:\u002F\u002Favd.aquasec.com\u002Fnvd\u002Fcve-2022-25883\",\n          \"References\": [\n            \"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-25883\",\n            \"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-c2qf-rxjj-qqgw\"\n          ],\n          \"DataSource\": {\n            \"ID\": \"ghsa\",\n            \"Name\": \"GitHub Security Advisory npm\"\n          },\n          \"PublishedDate\": \"2022-11-16T14:15:00Z\",\n          \"LastModifiedDate\": \"2023-09-01T10:00:00Z\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n## Data Extraction Fields\n\nFor each vulnerability record:\n\n| Field | Source | Notes |\n|-------|--------|-------|\n| `VulnerabilityID` | Direct | Primary CVE ID (handle comma-separated) |\n| `PkgName` | Direct | Package name (may include scope) |\n| `InstalledVersion` | Direct | Exact installed version |\n| `FixedVersion` | Direct | First fixed version (may have multiple) |\n| `Severity` | `Severity` field | HIGH or CRITICAL only |\n| `SeveritySource` | Track source | ghsa, nvd, or other |\n| `Title` | Direct | Vulnerability title |\n| `PrimaryURL` | Direct | Primary reference URL |\n| References | Direct | All reference URLs |\n\n## Severity Filtering\n\n### Valid Severities for This Audit\n- HIGH\n- CRITICAL\n\n### Severity Source Priority\n1. GHSA (GitHub) - Most recent data\n2. NVD (NIST) - Most authoritative\n3. RedHat - Vendor-specific\n4. Ubuntu - Ubuntu-specific\n5. Other sources - Use if available\n\n## Vendor Severity Codes\n\nGHSA uses numeric severity codes:\n- 0 = LOW\n- 1 = MODERATE\n- 2 = MEDIUM\n- 3 = HIGH\n- 4 = CRITICAL\n\nNVD uses numeric CVSS scores (0.0-10.0)\n\n## Handling Edge Cases\n\n### Multiple CVE IDs\nSome vulnerabilities may report multiple CVE IDs separated by commas:\n```\n\"CVE-2023-XXXXX, CVE-2023-YYYYY\"\n```\nSplit and process each separately while maintaining package\u002Fversion context.\n\n### Multiple Fixed Versions\nWhen multiple branches are maintained:\n```\n\"FixedVersion\": \"7.5.2, 6.3.1, 5.7.2\"\n```\nExtract the first fixed version for the matched major version if possible.\n\n### Incomplete FixedVersion Data\nSome vulnerabilities may not have fixes:\n```\n\"FixedVersion\": \"\"\n```\nUse \"N\u002FA\" in reports.\n\n## Reference URL Priority\n\n1. `PrimaryURL`: Use as primary reference\n2. `References` array: Include if primary is missing\n3. Construct NVD URL if needed: `https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002F{CVE-ID}`\n\n## Audit Trail Elements\n\nTrack for audit purposes:\n- DataSource.ID: Which database provided the vulnerability info\n- DataSource.Name: Human-readable database name\n- PublishedDate: When the CVE was published\n- LastModifiedDate: When the record was last updated\n\nThis enables tracking which vulnerabilities came from which sources and how current the data is.\n",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb2-self-feedback-claude-haiku-4-5\u002Fdependency-vulnerability-check\u002Frun2_npm-vulnerability-scanning-enhanced",7,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill run2_npm-vulnerability-scanning-enhanced",{"tool":48,"command":49},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill run2_npm-vulnerability-scanning-enhanced",{"tool":51,"command":52},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill run2_npm-vulnerability-scanning-enhanced","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-claude-haiku-4-5\u002Fdependency-vulnerability-check\u002Frun2_npm-vulnerability-scanning-enhanced\u002FSKILL.md",true,[],[57,75,100,118,138,150],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":68,"publishedAt":29},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[63],{"categoryNo":64,"categoryName":65,"taxonomyType":66,"taxonomyTypeDesc":67},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[69,70,71,72,73,74],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":84,"publishedAt":29},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[81],{"categoryNo":82,"categoryName":83,"taxonomyType":66,"taxonomyTypeDesc":67},"01JBSEEDCAT000000000000023","Skill与智能体开发",[85,86,87,88,89,90,91,92,93,94,95,96,97,98,99],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","for","user","it","requirements","essential","itineraries",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":29},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[107,108,109,110,111,112,113,88,114,115,89,116,94,117,86],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":29},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[125,126,127,94,128,129,130,131,132,133,134,135,116,136,137],"glm output","output","glm","tasks","metrics","json","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":29},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[144],{"categoryNo":82,"categoryName":83,"taxonomyType":66,"taxonomyTypeDesc":67},[146,137,127,126,132,131,128,147,148,94,149],"glm calibration","setup","companion","metric",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":29},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[157,127,131,158,146,137,94,126,159,160,161,162,163,164,128],"glm basics","inspect","relevant","files","good","use","how","Evaluation"]