[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KJB2FHHRWGZFTWC7VT4M0J":3,"skill-same:01M6KJB2FHHRWGZFTWC7VT4M0J":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":69},"01M6KJB2FHHRWGZFTWC7VT4M0J","vulnerability-data-processing",null,"Process vulnerability scan results from Trivy JSON output, extract HIGH\u002FCRITICAL severity vulnerabilities with complete metadata (CVE, CVSS scores, fix versions, references). Use this skill whenever you need to transform raw vulnerability data into structured format with proper field mapping and CVSS score prioritization.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",93,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb4-skill-creator-claude-haiku-4-5\u002Fdependency-vulnerability-check\u002Fvulnerability-data-processing\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"vulnerability data processing","data","vulnerability","processing","data processing","references","you","output","transform","mapping","complete","critical","scan","cve","use","fix","prioritization","cvss","severity","JSON Output","2026-11-10 10:12:30",false,"---\nname: vulnerability-data-processing\ndescription: Process vulnerability scan results from Trivy JSON output, extract HIGH\u002FCRITICAL severity vulnerabilities with complete metadata (CVE, CVSS scores, fix versions, references). Use this skill whenever you need to transform raw vulnerability data into structured format with proper field mapping and CVSS score prioritization.\n---\n\n# Vulnerability Data Processing and Extraction\n\n## Overview\n\nThis skill handles transforming raw Trivy JSON vulnerability scan results into structured data for reporting. It handles field extraction, CVSS score selection, and data validation.\n\n## Input Format\n\nTrivy JSON output with structure:\n```json\n{\n  \"Results\": [\n    {\n      \"Target\": \"package-lock.json\",\n      \"Type\": \"npm\",\n      \"Vulnerabilities\": [\n        {\n          \"VulnerabilityID\": \"CVE-2021-12345\",\n          \"PkgName\": \"package-name\",\n          \"InstalledVersion\": \"1.0.0\",\n          \"FixedVersion\": \"1.0.1\",\n          \"Severity\": \"HIGH\",\n          \"Title\": \"Vulnerability description\",\n          \"Description\": \"Detailed description\",\n          \"CVSS\": {\n            \"nvd\": {\n              \"V3Vector\": \"CVSS:3.1\u002FAV:N\u002FAC:L\u002F...\",\n              \"V3Score\": 7.5\n            },\n            \"ghsa\": {\n              \"V3Score\": 7.4\n            }\n          },\n          \"References\": [\"https:\u002F\u002F...\"]\n        }\n      ]\n    }\n  ]\n}\n```\n\n## Processing Steps\n\n### 1. Parse Trivy JSON Output\n\nRead the JSON file and validate structure:\n- Check that `Results` array exists\n- Filter to `Results[].Vulnerabilities[]` entries\n- Skip if `Vulnerabilities` is empty or null\n\n### 2. Filter by Severity\n\nKeep only `Severity == \"HIGH\"` or `Severity == \"CRITICAL\"`.\n\n### 3. Extract CVSS Score\n\nCVSS scores are nested under the `CVSS` object with multiple sources. Extract in priority:\n\n```python\ndef get_cvss_score(vuln):\n    cvss = vuln.get(\"CVSS\", {})\n\n    # Priority: NVD > GHSA > RedHat\n    if \"nvd\" in cvss and \"V3Score\" in cvss[\"nvd\"]:\n        return cvss[\"nvd\"][\"V3Score\"]\n    if \"ghsa\" in cvss and \"V3Score\" in cvss[\"ghsa\"]:\n        return cvss[\"ghsa\"][\"V3Score\"]\n    if \"redhat\" in cvss and \"V3Score\" in cvss[\"redhat\"]:\n        return cvss[\"redhat\"][\"V3Score\"]\n\n    return None  # Mark as N\u002FA if missing\n```\n\n### 4. Extract Fixed Version\n\n```python\nfixed = vuln.get(\"FixedVersion\", \"\")\nfixed_version = fixed if fixed else \"N\u002FA\"\n```\n\n### 5. Extract Reference URL\n\nTake the first valid HTTP\u002FHTTPS URL from the References array:\n\n```python\nreferences = vuln.get(\"References\", [])\nurl = next((ref for ref in references if ref.startswith(\"http\")), \"N\u002FA\")\n```\n\n### 6. Build Output Record\n\nMap each vulnerability to:\n\n```python\nrecord = {\n    \"Package\": vuln[\"PkgName\"],\n    \"Version\": vuln[\"InstalledVersion\"],\n    \"CVE_ID\": vuln[\"VulnerabilityID\"],\n    \"Severity\": vuln[\"Severity\"],\n    \"CVSS_Score\": cvss_score if cvss_score else \"N\u002FA\",\n    \"Fixed_Version\": fixed_version,\n    \"Title\": vuln.get(\"Title\", vuln.get(\"Description\", \"N\u002FA\")),\n    \"Url\": url\n}\n```\n\n### 7. Deduplication\n\nIf the same CVE appears multiple times (different packages), keep all entries. If the same package+CVE appears multiple times, keep first occurrence.\n\n## Validation Checks\n\n- **CVE_ID format**: Should match `CVE-\\d{4}-\\d{4,}` pattern\n- **Severity**: Must be \"HIGH\" or \"CRITICAL\"\n- **CVSS_Score**: Should be numeric 0-10 or \"N\u002FA\"\n- **Version fields**: Non-empty strings\n- **Title length**: Use first 200 chars if exceeds limit\n\n## Python Implementation Pattern\n\n```python\nimport json\n\ndef process_vulnerabilities(json_file):\n    with open(json_file, 'r') as f:\n        data = json.load(f)\n\n    records = []\n    for result in data.get(\"Results\", []):\n        for vuln in result.get(\"Vulnerabilities\", []):\n            if vuln[\"Severity\"] not in [\"HIGH\", \"CRITICAL\"]:\n                continue\n\n            # Extract fields (use helper functions above)\n            record = {\n                \"Package\": vuln[\"PkgName\"],\n                \"Version\": vuln[\"InstalledVersion\"],\n                \"CVE_ID\": vuln[\"VulnerabilityID\"],\n                \"Severity\": vuln[\"Severity\"],\n                \"CVSS_Score\": get_cvss_score(vuln),\n                \"Fixed_Version\": vuln.get(\"FixedVersion\") or \"N\u002FA\",\n                \"Title\": vuln.get(\"Title\", \"\"),\n                \"Url\": get_first_url(vuln.get(\"References\", []))\n            }\n            records.append(record)\n\n    return records\n```\n\n## Common Field Transformations\n\n| Source Field | Target Field | Transformation |\n|--------------|--------------|-----------------|\n| VulnerabilityID | CVE_ID | Use as-is |\n| PkgName | Package | Use as-is |\n| InstalledVersion | Version | Use as-is |\n| FixedVersion | Fixed_Version | Empty → \"N\u002FA\" |\n| Severity | Severity | Use as-is (pre-filtered) |\n| CVSS.*.V3Score | CVSS_Score | Select first available, fallback \"N\u002FA\" |\n| Title\u002FDescription | Title | Prefer Title, fallback to Description |\n| References[0] | Url | Extract first HTTP URL, fallback \"N\u002FA\" |\n\n## Error Handling\n\n- **Invalid JSON**: Log error and exit — file must be valid JSON\n- **Missing fields**: Use \"N\u002FA\" as fallback\n- **Empty results**: Return empty list (no vulnerabilities found)\n- **Malformed severity**: Log warning and skip record\n\n## Output\n\nReturns list of dictionaries ready for CSV export:\n```python\n[\n    {\n        \"Package\": \"express\",\n        \"Version\": \"4.17.1\",\n        \"CVE_ID\": \"CVE-2022-12345\",\n        \"Severity\": \"HIGH\",\n        \"CVSS_Score\": 7.5,\n        \"Fixed_Version\": \"4.17.2\",\n        \"Title\": \"Vulnerability in express\",\n        \"Url\": \"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-12345\"\n    },\n    ...\n]\n```\n\n## Next Steps\n\nPass the processed records to the CSV export skill for final report generation.\n","# Vulnerability Data Processing and Extraction\n\n## Overview\n\nThis skill handles transforming raw Trivy JSON vulnerability scan results into structured data for reporting. It handles field extraction, CVSS score selection, and data validation.\n\n## Input Format\n\nTrivy JSON output with structure:\n```json\n{\n  \"Results\": [\n    {\n      \"Target\": \"package-lock.json\",\n      \"Type\": \"npm\",\n      \"Vulnerabilities\": [\n        {\n          \"VulnerabilityID\": \"CVE-2021-12345\",\n          \"PkgName\": \"package-name\",\n          \"InstalledVersion\": \"1.0.0\",\n          \"FixedVersion\": \"1.0.1\",\n          \"Severity\": \"HIGH\",\n          \"Title\": \"Vulnerability description\",\n          \"Description\": \"Detailed description\",\n          \"CVSS\": {\n            \"nvd\": {\n              \"V3Vector\": \"CVSS:3.1\u002FAV:N\u002FAC:L\u002F...\",\n              \"V3Score\": 7.5\n            },\n            \"ghsa\": {\n              \"V3Score\": 7.4\n            }\n          },\n          \"References\": [\"https:\u002F\u002F...\"]\n        }\n      ]\n    }\n  ]\n}\n```\n\n## Processing Steps\n\n### 1. Parse Trivy JSON Output\n\nRead the JSON file and validate structure:\n- Check that `Results` array exists\n- Filter to `Results[].Vulnerabilities[]` entries\n- Skip if `Vulnerabilities` is empty or null\n\n### 2. Filter by Severity\n\nKeep only `Severity == \"HIGH\"` or `Severity == \"CRITICAL\"`.\n\n### 3. Extract CVSS Score\n\nCVSS scores are nested under the `CVSS` object with multiple sources. Extract in priority:\n\n```python\ndef get_cvss_score(vuln):\n    cvss = vuln.get(\"CVSS\", {})\n\n    # Priority: NVD > GHSA > RedHat\n    if \"nvd\" in cvss and \"V3Score\" in cvss[\"nvd\"]:\n        return cvss[\"nvd\"][\"V3Score\"]\n    if \"ghsa\" in cvss and \"V3Score\" in cvss[\"ghsa\"]:\n        return cvss[\"ghsa\"][\"V3Score\"]\n    if \"redhat\" in cvss and \"V3Score\" in cvss[\"redhat\"]:\n        return cvss[\"redhat\"][\"V3Score\"]\n\n    return None  # Mark as N\u002FA if missing\n```\n\n### 4. Extract Fixed Version\n\n```python\nfixed = vuln.get(\"FixedVersion\", \"\")\nfixed_version = fixed if fixed else \"N\u002FA\"\n```\n\n### 5. Extract Reference URL\n\nTake the first valid HTTP\u002FHTTPS URL from the References array:\n\n```python\nreferences = vuln.get(\"References\", [])\nurl = next((ref for ref in references if ref.startswith(\"http\")), \"N\u002FA\")\n```\n\n### 6. Build Output Record\n\nMap each vulnerability to:\n\n```python\nrecord = {\n    \"Package\": vuln[\"PkgName\"],\n    \"Version\": vuln[\"InstalledVersion\"],\n    \"CVE_ID\": vuln[\"VulnerabilityID\"],\n    \"Severity\": vuln[\"Severity\"],\n    \"CVSS_Score\": cvss_score if cvss_score else \"N\u002FA\",\n    \"Fixed_Version\": fixed_version,\n    \"Title\": vuln.get(\"Title\", vuln.get(\"Description\", \"N\u002FA\")),\n    \"Url\": url\n}\n```\n\n### 7. Deduplication\n\nIf the same CVE appears multiple times (different packages), keep all entries. If the same package+CVE appears multiple times, keep first occurrence.\n\n## Validation Checks\n\n- **CVE_ID format**: Should match `CVE-\\d{4}-\\d{4,}` pattern\n- **Severity**: Must be \"HIGH\" or \"CRITICAL\"\n- **CVSS_Score**: Should be numeric 0-10 or \"N\u002FA\"\n- **Version fields**: Non-empty strings\n- **Title length**: Use first 200 chars if exceeds limit\n\n## Python Implementation Pattern\n\n```python\nimport json\n\ndef process_vulnerabilities(json_file):\n    with open(json_file, 'r') as f:\n        data = json.load(f)\n\n    records = []\n    for result in data.get(\"Results\", []):\n        for vuln in result.get(\"Vulnerabilities\", []):\n            if vuln[\"Severity\"] not in [\"HIGH\", \"CRITICAL\"]:\n                continue\n\n            # Extract fields (use helper functions above)\n            record = {\n                \"Package\": vuln[\"PkgName\"],\n                \"Version\": vuln[\"InstalledVersion\"],\n                \"CVE_ID\": vuln[\"VulnerabilityID\"],\n                \"Severity\": vuln[\"Severity\"],\n                \"CVSS_Score\": get_cvss_score(vuln),\n                \"Fixed_Version\": vuln.get(\"FixedVersion\") or \"N\u002FA\",\n                \"Title\": vuln.get(\"Title\", \"\"),\n                \"Url\": get_first_url(vuln.get(\"References\", []))\n            }\n            records.append(record)\n\n    return records\n```\n\n## Common Field Transformations\n\n| Source Field | Target Field | Transformation |\n|--------------|--------------|-----------------|\n| VulnerabilityID | CVE_ID | Use as-is |\n| PkgName | Package | Use as-is |\n| InstalledVersion | Version | Use as-is |\n| FixedVersion | Fixed_Version | Empty → \"N\u002FA\" |\n| Severity | Severity | Use as-is (pre-filtered) |\n| CVSS.*.V3Score | CVSS_Score | Select first available, fallback \"N\u002FA\" |\n| Title\u002FDescription | Title | Prefer Title, fallback to Description |\n| References[0] | Url | Extract first HTTP URL, fallback \"N\u002FA\" |\n\n## Error Handling\n\n- **Invalid JSON**: Log error and exit — file must be valid JSON\n- **Missing fields**: Use \"N\u002FA\" as fallback\n- **Empty results**: Return empty list (no vulnerabilities found)\n- **Malformed severity**: Log warning and skip record\n\n## Output\n\nReturns list of dictionaries ready for CSV export:\n```python\n[\n    {\n        \"Package\": \"express\",\n        \"Version\": \"4.17.1\",\n        \"CVE_ID\": \"CVE-2022-12345\",\n        \"Severity\": \"HIGH\",\n        \"CVSS_Score\": 7.5,\n        \"Fixed_Version\": \"4.17.2\",\n        \"Title\": \"Vulnerability in express\",\n        \"Url\": \"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-12345\"\n    },\n    ...\n]\n```\n\n## Next Steps\n\nPass the processed records to the CSV export skill for final report generation.\n",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb4-skill-creator-claude-haiku-4-5\u002Fdependency-vulnerability-check\u002Fvulnerability-data-processing",8,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill vulnerability-data-processing",{"tool":62,"command":63},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill vulnerability-data-processing",{"tool":65,"command":66},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill vulnerability-data-processing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb4-skill-creator-claude-haiku-4-5\u002Fdependency-vulnerability-check\u002Fvulnerability-data-processing\u002FSKILL.md",true,[],[71,89,114,131,149,161],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":82,"publishedAt":43},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[77],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[83,84,85,86,87,88],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":98,"publishedAt":43},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[95],{"categoryNo":96,"categoryName":97,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000023","Skill与智能体开发",[99,100,101,102,103,104,105,106,107,108,109,110,111,112,113],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","for","user","it","requirements","essential","itineraries",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":43},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[121,122,123,124,125,126,127,102,128,129,103,29,108,130,100],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","database",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":43},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[138,30,139,108,140,141,142,143,144,145,146,26,29,147,148],"glm output","glm","tasks","metrics","json","basics","guidance","matching","verifier","root","calibration",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":43},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[155],{"categoryNo":96,"categoryName":97,"taxonomyType":80,"taxonomyTypeDesc":81},[157,148,139,30,144,143,140,158,159,108,160],"glm calibration","setup","companion","metric",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":43},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[168,139,143,169,157,148,108,30,170,171,172,37,173,174,140],"glm basics","inspect","relevant","files","good","how","Evaluation"]