/cve-research

name: cve-research
description: "Use when checking a specific dependency or package version for known CVEs and security advisories (OSV, GitHub Advisory, NVD), with CVSS, CWE and reachability verification before anything is reported as a finding."
argument-hint: "<package-name> [version] [ecosystem]"
user-invocable: true

<objective> This skill researches known vulnerabilities for one dependency at the version actually installed, across OSV.dev, the GitHub Advisory Database and NVD, then a web search for advisories not yet indexed. Each candidate is scored (CVSS vector + score + CVSS version + scoring source, CWE) and must pass two mandatory checks before it becomes a finding: the affected version is the one installed, and the vulnerable code is reachable from the project.

It reports; it never upgrades the dependency. Out of scope: a full project dependency sweep (use dependency-audit). </objective>

CVE Research Skill

Data sources (query in this order)

| Order | Source | Endpoint | Strength | |-------|--------|----------|----------| | 1 | OSV.dev | `api.osv.dev/v1` | Package + version matching, aliases (GHSA, CVE, RUSTSEC, GO, PYSEC) | | 2 | GitHub Advisory | `api.github.com/advisories` | Reviewed ranges, first patched version, CVSS v3/v4, CWE, EPSS, malware type | | 3 | NVD | `services.nvd.nist.gov/rest/json/cves/2.0` | NVD and CNA CVSS metrics, CWE, CISA KEV fields | | 4 | Web search | fuse-browser `browser_fetch` / Exa when available | Advisories not yet indexed, maintainer notes |

Endpoints, bodies and rate limits: [CVE APIs Reference](references/cve-apis.md). Ready-to-run requests: [Query Templates](references/templates/cve-query.md).

Workflow

1. **Resolve the installed version** from the lockfile (not the manifest range). 2. **Query** OSV (`/v1/query` with ecosystem + name + version), collect IDs and aliases. 3. **Enrich** each ID: GitHub Advisory (CVSS, CWE, patched version), NVD (CVSS by source, KEV). 4. **Search** the web for the package name plus the current year, computed at run time (`date +%Y`), never a year written in this skill. 5. **Score**: CVSS vector + base score, the CVSS version, and who scored it; CWE id. 6. **Verify (mandatory)** — [Severity and Reachability](references/severity-and-reachability.md): version check, reachability check, refutation pass. Confidence 1-10; only ≥ 8 is a finding. 7. **Report** with fix version or workaround as an option for the owner.

CVSS bands (FIRST qualitative scale, CVSS v3.x and v4.0)

The band is an input. The reported severity follows the plugin's single scale in `rules/security-rules.md`, decided after the reachability check.

| CVSS base score | Band | |-----------------|----------| | 9.0 - 10.0 | CRITICAL | | 7.0 - 8.9 | HIGH | | 4.0 - 6.9 | MEDIUM | | 0.1 - 3.9 | LOW |

When sources disagree (e.g. NVD scores v3.1 HIGH while the CNA scores v4.0 CRITICAL), report both with their source and use the highest for ordering. A CVE listed in CISA KEV (`cisaExploitAdd` in the NVD record) is noted as exploited in the wild.

Output per finding

id (GHSA/CVE + aliases), title, severity, confidence 1-10, CWE, standard reference (OWASP Top 10:2025 A03 Software Supply Chain Failures for a vulnerable dependency), package@version, evidence (advisory, affected range, installed version, reachability), exploit scenario, recommendation (fixed version / workaround).

References

• [CVE APIs Reference](references/cve-apis.md)
• [Severity and Reachability](references/severity-and-reachability.md)
• [Query Templates](references/templates/cve-query.md)