run2_cvss-score
Extract CVSS v3 scores from Trivy vulnerability data with source priority fallback (NVD > GHSA > RedHat) and handle missing data gracefully.
- License 许可
- MIT
- 最近更新
- 2026-10-02
- Stars
- ★ 92
- Forks
- 7
01 前言 Front Matter
- name
- run2_cvss-score
- description
- Extract CVSS v3 scores from Trivy vulnerability data with source priority fallback (NVD > GHSA > RedHat) and handle missing data gracefully.
03 SKILL.md 正文
CVSS Score Extraction from Trivy Data
CVSS Sources in Trivy Output
Trivy provides CVSS scores from multiple sources in the CVSS field:
- nvd: National Vulnerability Database (most authoritative)
- ghsa: GitHub Security Advisory
- redhat: Red Hat security team
Not all sources are present for every vulnerability.
Recommended Priority: NVD > GHSA > RedHat
NVD is the standard reference. GHSA is widely used for npm/GitHub ecosystems. RedHat is useful as a fallback.
Python Implementation
def get_cvss_score(vuln):
"""Extract best available CVSS v3 score with source priority fallback."""
cvss = vuln.get("CVSS") or {}
for source in ["nvd", "ghsa", "redhat"]:
entry = cvss.get(source)
if entry:
score = entry.get("V3Score")
if score is not None:
return score
return "N/A"
Real-world examples from npm scanning
- CVE-2024-29415 (ip): Only ghsa (8.1) and redhat (9.8) — no NVD score → returns 8.1
- CVE-2022-25883 (semver): All three sources at 7.5 → returns 7.5
- CVE-2026-23745 (tar): Only redhat (8.2) → returns 8.2
04 同仓库更多 Skills
object_counter
Count occurrences of an object in the image using computer vision algorithm.
travel-planning-workflow
Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.
bundled-dataset-search-tool
invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.
glm-output
Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final /root/metrics.json.
glm-calibration
Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.
glm-basics
A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.