[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KGD3SKVB98KA3CYKF48K5C":3,"skill-same:01M6KGD3SKVB98KA3CYKF48K5C":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":37,"repositoryHtmlUrl":38,"repositoryHomepageUrl":39,"ownerHtmlUrl":40,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":41,"install":42,"resources":55},"01M6KGD3SKVB98KA3CYKF48K5C","run2_cvss-extraction",null,"Advanced robust CVSS extraction logic that correctly falls back across priority sources and handles missing values.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",93,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-gemini-3.1-pro-preview\u002Fdependency-vulnerability-check\u002Frun2_cvss-extraction\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28],"extraction","cvss","cvss extraction","run2 cvss extraction","back","across","logic","missing","sources","advanced","values","2026-11-10 10:12:30",false,"---\nname: run2_cvss-extraction\ndescription: Advanced robust CVSS extraction logic that correctly falls back across priority sources and handles missing values.\n---\n\n# Robust CVSS Score Extraction\n\nExtracting a valid and reliable CVSS (Common Vulnerability Scoring System) score is critical when processing security audits. Scanners often compile scoring metrics from various providers. To guarantee data consistency, it is crucial to establish a fallback strategy across providers, preferring comprehensive databases like NVD over vendor-specific sources like RedHat.\n\n## Priority Strategy\nThe established priority order for pulling CVSS data from Trivy's JSON reports is:\n1. `nvd` (National Vulnerability Database, highly authoritative)\n2. `ghsa` (GitHub Security Advisory, reliable for open-source)\n3. `redhat` (Vendor specific, but valid for many OS-level vulnerabilities)\n\n## Implementation\nYou should primarily seek the CVSS v3 score (`V3Score`), falling back to `V2Score` if no `V3Score` exists. If neither score is present or the `CVSS` field is entirely missing, a safe string like `'N\u002FA'` must be returned to avoid crashing the downstream CSV generation.\n\n### Enhanced Code Example\n\n```python\ndef extract_cvss_score_with_fallback(vuln_dict):\n    \"\"\"\n    Safely extract the CVSS score using a fallback strategy.\n    Priority: nvd > ghsa > redhat.\n    Within each priority, V3Score is preferred, followed by V2Score.\n    \n    Args:\n        vuln_dict (dict): The vulnerability dictionary object parsed from Trivy JSON.\n        \n    Returns:\n        float or str: The CVSS score as a float, or 'N\u002FA' if missing.\n    \"\"\"\n    cvss = vuln_dict.get('CVSS', {})\n    \n    # Priority order for sources\n    sources = ['nvd', 'ghsa', 'redhat']\n    \n    for source in sources:\n        if source in cvss:\n            # First try CVSS v3 score\n            v3_score = cvss[source].get('V3Score')\n            if v3_score is not None:\n                return float(v3_score)\n                \n            # Fall back to CVSS v2 score\n            v2_score = cvss[source].get('V2Score')\n            if v2_score is not None:\n                return float(v2_score)\n                \n    # If no score was found at all, return N\u002FA\n    return 'N\u002FA'\n\n# Example usage\nsample_vuln = {\n    \"VulnerabilityID\": \"CVE-1234\",\n    \"CVSS\": {\n        \"ghsa\": {\n            \"V3Score\": 8.5\n        }\n    }\n}\nscore = extract_cvss_score_with_fallback(sample_vuln)\n# score will be 8.5\n```\n\n### Type Safety\nExplicitly casting the score to `float()` (or checking its type before casting) is a good practice if your CSV parser expects a consistent datatype to apply mathematical thresholds (e.g., `score >= 7.0`), though simply returning the numeric type provided by the JSON parser is usually acceptable.\n","# Robust CVSS Score Extraction\n\nExtracting a valid and reliable CVSS (Common Vulnerability Scoring System) score is critical when processing security audits. Scanners often compile scoring metrics from various providers. To guarantee data consistency, it is crucial to establish a fallback strategy across providers, preferring comprehensive databases like NVD over vendor-specific sources like RedHat.\n\n## Priority Strategy\nThe established priority order for pulling CVSS data from Trivy's JSON reports is:\n1. `nvd` (National Vulnerability Database, highly authoritative)\n2. `ghsa` (GitHub Security Advisory, reliable for open-source)\n3. `redhat` (Vendor specific, but valid for many OS-level vulnerabilities)\n\n## Implementation\nYou should primarily seek the CVSS v3 score (`V3Score`), falling back to `V2Score` if no `V3Score` exists. If neither score is present or the `CVSS` field is entirely missing, a safe string like `'N\u002FA'` must be returned to avoid crashing the downstream CSV generation.\n\n### Enhanced Code Example\n\n```python\ndef extract_cvss_score_with_fallback(vuln_dict):\n    \"\"\"\n    Safely extract the CVSS score using a fallback strategy.\n    Priority: nvd > ghsa > redhat.\n    Within each priority, V3Score is preferred, followed by V2Score.\n    \n    Args:\n        vuln_dict (dict): The vulnerability dictionary object parsed from Trivy JSON.\n        \n    Returns:\n        float or str: The CVSS score as a float, or 'N\u002FA' if missing.\n    \"\"\"\n    cvss = vuln_dict.get('CVSS', {})\n    \n    # Priority order for sources\n    sources = ['nvd', 'ghsa', 'redhat']\n    \n    for source in sources:\n        if source in cvss:\n            # First try CVSS v3 score\n            v3_score = cvss[source].get('V3Score')\n            if v3_score is not None:\n                return float(v3_score)\n                \n            # Fall back to CVSS v2 score\n            v2_score = cvss[source].get('V2Score')\n            if v2_score is not None:\n                return float(v2_score)\n                \n    # If no score was found at all, return N\u002FA\n    return 'N\u002FA'\n\n# Example usage\nsample_vuln = {\n    \"VulnerabilityID\": \"CVE-1234\",\n    \"CVSS\": {\n        \"ghsa\": {\n            \"V3Score\": 8.5\n        }\n    }\n}\nscore = extract_cvss_score_with_fallback(sample_vuln)\n# score will be 8.5\n```\n\n### Type Safety\nExplicitly casting the score to `float()` (or checking its type before casting) is a good practice if your CSV parser expects a consistent datatype to apply mathematical thresholds (e.g., `score >= 7.0`), though simply returning the numeric type provided by the JSON parser is usually acceptable.\n",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb2-self-feedback-gemini-3.1-pro-preview\u002Fdependency-vulnerability-check\u002Frun2_cvss-extraction",7,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill run2_cvss-extraction",{"tool":48,"command":49},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill run2_cvss-extraction",{"tool":51,"command":52},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill run2_cvss-extraction","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-gemini-3.1-pro-preview\u002Fdependency-vulnerability-check\u002Frun2_cvss-extraction\u002FSKILL.md",true,[],[57,75,100,118,138,150],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":68,"publishedAt":29},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[63],{"categoryNo":64,"categoryName":65,"taxonomyType":66,"taxonomyTypeDesc":67},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[69,70,71,72,73,74],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":84,"publishedAt":29},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[81],{"categoryNo":82,"categoryName":83,"taxonomyType":66,"taxonomyTypeDesc":67},"01JBSEEDCAT000000000000023","Skill与智能体开发",[85,86,87,88,89,90,91,92,93,94,95,96,97,98,99],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","for","user","it","requirements","essential","itineraries",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":29},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[107,108,109,110,111,112,113,88,114,115,89,116,94,117,86],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":29},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[125,126,127,94,128,129,130,131,132,133,134,135,116,136,137],"glm output","output","glm","tasks","metrics","json","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":29},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[144],{"categoryNo":82,"categoryName":83,"taxonomyType":66,"taxonomyTypeDesc":67},[146,137,127,126,132,131,128,147,148,94,149],"glm calibration","setup","companion","metric",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":29},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[157,127,131,158,146,137,94,126,159,160,161,162,163,164,128],"glm basics","inspect","relevant","files","good","use","how","Evaluation"]