run2_cvss-score-extraction
Extract CVSS v3 scores from Trivy vulnerability JSON with source priority (NVD > GHSA > RedHat) and fallback to N/A.
- License 许可
- MIT
- 最近更新
- 2026-10-02
- Stars
- ★ 92
- Forks
- 7
01 前言 Front Matter
- name
- run2_cvss-score-extraction
- description
- Extract CVSS v3 scores from Trivy vulnerability JSON with source priority (NVD > GHSA > RedHat) and fallback to N/A.
03 SKILL.md 正文
CVSS Score Extraction (Round 2)
Priority Order
NVD V3Score → GHSA V3Score → RedHat V3Score → N/A
Do NOT fall back to V2Score — severity labels (HIGH/CRITICAL) come from Trivy's own assessment and are already correct; we only need the numeric score for reporting.
Canonical Implementation
def get_cvss_score(vuln):
"""
Extract CVSS v3 score with source priority: NVD > GHSA > RedHat.
Returns float score or string 'N/A'.
"""
cvss = vuln.get('CVSS', {})
if not isinstance(cvss, dict):
return 'N/A'
for source in ['nvd', 'ghsa', 'redhat']:
entry = cvss.get(source, {})
if isinstance(entry, dict):
score = entry.get('V3Score')
if score is not None and isinstance(score, (int, float)):
return score
return 'N/A'
Real-World Examples from This Task
| CVE | NVD | GHSA | RedHat | Result |
|---|---|---|---|---|
| CVE-2024-29415 (ip) | - | 8.1 | 9.8 | 8.1 (GHSA wins, NVD absent) |
| CVE-2022-25883 (semver) | 7.5 | 7.5 | 7.5 | 7.5 (NVD wins) |
| CVE-2026-23745 (tar) | - | - | 8.2 | 8.2 (RedHat only) |
Notes
- Source keys in Trivy JSON are lowercase:
nvd,ghsa,redhat - Only
V3Scorefield is relevant (notV3Vector) - When NVD is absent, GHSA is usually the next best source
04 同仓库更多 Skills
object_counter
Count occurrences of an object in the image using computer vision algorithm.
travel-planning-workflow
Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.
bundled-dataset-search-tool
invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.
glm-output
Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final /root/metrics.json.
glm-calibration
Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.
glm-basics
A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.